Fix the WordPress login redirect loop

You enter the right username and password, WordPress accepts them, and then shows the login page again, or bounces between wp-login.php and wp-admin. This is a login redirect loop. WordPress cannot keep your login cookie, or keeps redirecting you to a different address than the one you logged in on.

Before you start

• Try a private browser window. If that works, the problem is old cookies in your normal browser.
• Have cPanel File Manager access ready.

Clear cookies and cache

Delete cookies for your domain in the browser settings (both with and without www), close the browser and try again. Login cookies from an old address or protocol are the most common cause.

Check the site address

If Settings → General says https://www.example.com but you log in at https://example.com, the cookie is set for one host and WordPress redirects you to the other. Since you cannot reach the dashboard, check the values in phpMyAdmin:

1. Open cPanel → Databases → phpMyAdmin, select the site's database and open the options table.
2. Look at siteurl and home. Both must be the exact address you use, including https:// and www or not.
3. Correct them, or set them temporarily in wp-config.php:

define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );

Fix HTTPS mismatches

• If the site runs behind Cloudflare in Flexible SSL mode, WordPress sees plain HTTP while the browser uses HTTPS, which can loop with FORCE_SSL_ADMIN. Switch Cloudflare to Full (strict).
• Make sure there is only one HTTP-to-HTTPS redirect: either cPanel's Force HTTPS Redirect or an .htaccess rule or a plugin, not several.

Exclude login pages from caching

A cache that stores wp-login.php or wp-admin pages serves you a logged-out copy. LiteSpeed Cache excludes these by default, but CDN page rules or a second cache plugin may not. Purge all caches and remove any "cache everything" rule that covers /wp-admin* or /wp-login.php.

Disable plugins

Security, membership and redirect plugins can intercept logins. In File Manager rename wp-content/plugins to plugins-off and try to log in. If it works, rename the folder back and reactivate plugins one by one to find the cause.

Reset .htaccess

Rename .htaccess to .htaccess-old, log in, then re-save Settings → Permalinks to create a clean file. Copy back only the rules you need.

Check cookie constants

Lines such as COOKIE_DOMAIN, COOKIEPATH or ADMIN_COOKIE_PATH in wp-config.php left over from a migration or multisite setup can break login on a normal site. Remove them unless you know they are needed.

Regenerate security keys

Replacing the keys and salts in wp-config.php invalidates all existing cookies and sessions, which clears up corrupted sessions. Everyone has to log in again.

Troubleshooting

• Loop only for one user: that user's session data may be corrupt; delete the session_tokens row for the user in the usermeta table.
• "Cookies are blocked or not supported": the browser blocks cookies, or output before headers (often whitespace in wp-config.php) stops WordPress from setting them.
• Loop after moving to a new domain: the old domain is still stored in the database; run a search and replace.

Next steps

• Change the WordPress site URL
• Force HTTPS in WordPress correctly
• Reset a lost admin password