# WordPress login redirect loop > You submit correct credentials, WordPress sends you back to the login page, and nothing tells you why. Source: https://cwp.sg/errors/wordpress-login-redirect-loop/ Author: Ben Johnson Last verified: 2026-08-04 **Also seen as:** wp-admin redirects to wp-login, can't log in to WordPress, login page reloads ## What it means You enter the right username and password, the page reloads, and you're at the login screen again. No error about a wrong password — which is the clue. A wrong password produces an error message. A silent bounce back means the login **succeeded** and something immediately invalidated the session. There are three realistic reasons, in order of how often they're the cause: 1. WordPress's configured site URL doesn't match the address you're using, so the cookie is set for a different domain than the one you're on 2. Cookies aren't being stored or sent 3. A plugin is interfering with authentication Cause 1 is by far the most common, and it's why this appears right after moving a site, adding HTTPS, or switching between `www` and non-`www`. ## Why it happens ### The site URL doesn't match the address you're visiting WordPress sets its authentication cookie for the domain in its Site Address setting. If that says `http://example.com` and you're on `https://www.example.com`, the cookie is set for a domain your browser isn't on — so it never comes back, and the next request looks logged out. Same scheme, same host, every time. `www` and non-`www` are different hosts as far as cookies are concerned. ### Cookies aren't being set A caching plugin caching the login page, a browser extension blocking cookies, or a stale cookie from a previous configuration that's now invalid. ### A plugin is hooking authentication Security plugins, membership plugins and anything adding two-factor authentication all touch the login process. One misconfigured or half-updated plugin bounces you straight back. ### The redirect happens before the cookie is read A conflicting HTTPS or www redirect in `.htaccess` can redirect the POST before WordPress processes it, losing the login entirely. This overlaps with [ERR_TOO_MANY_REDIRECTS](/errors/err-too-many-redirects/) — same root cause, different symptom. ## How to fix it ### 1. Pin the site URLs in wp-config.php This overrides whatever is in the database and fixes most cases outright: ```php define('WP_HOME', 'https://example.com'); define('WP_SITEURL', 'https://example.com'); ``` No trailing slash. Both values must match exactly what you type in the address bar — including `https://` and including whether there's a `www`. Then visit that exact address. Typing the other variant will bounce you again. ### 2. Clear cookies for the domain A stale cookie from the old configuration will keep failing even after the settings are right. In Chrome: **Settings → Privacy → Third-party cookies → See all site data**, find the domain, delete. Or just use a private window to test, which starts with no cookies at all. This step is skipped constantly and it's why "I fixed it and it still doesn't work" happens. ### 3. Disable all plugins over FTP You can't do it from the admin panel if you can't get in: ``` mv wp-content/plugins wp-content/plugins.off ``` If you can log in now, a plugin is responsible. Rename the folder back, then rename individual plugin directories one at a time until it breaks again. Security and caching plugins are the usual culprits. ### 4. Stop the login page being cached A cached login page serves someone else's nonce and cannot work. Most caching plugins exclude `/wp-admin` and `/wp-login.php` by default, but check — a misconfigured page-cache rule is a common cause after switching caching plugins. ### 5. Define the cookie domain explicitly If you've confirmed the URLs are right and it still loops, force the cookie domain: ```php define('COOKIE_DOMAIN', 'example.com'); define('ADMIN_COOKIE_PATH', '/'); define('COOKIEPATH', '/'); define('SITECOOKIEPATH', '/'); ``` This is worth trying when the site is in a subdirectory or behind a proxy that rewrites the host header. ### 6. Rule out .htaccess redirects ``` mv .htaccess .htaccess.bak ``` If you can log in, a redirect rule is interfering. Restore it and remove any duplicate HTTPS or www redirects — you should have exactly one of each, in one place. The [.htaccess generator](/tools/htaccess-generator/) produces a proxy-safe version. Afterwards, regenerate WordPress's rules from **Settings → Permalinks → Save**. ## On CWP hosting specifically If you're using a free CWP subdomain, set `WP_HOME` and `WP_SITEURL` to the full `https://` subdomain address exactly as it appears in your control panel. We issue SSL automatically, so your site is reachable over both HTTP and HTTPS from the start — which makes the scheme mismatch above easy to hit if the URLs were saved before the certificate was issued. --- Content Website Platform (cwp.sg) operates the free hosting it writes about; see https://cwp.sg/about/ for the methodology and the commercial disclosure.