Can I fix the login redirect loop through phpMyAdmin?

Yes. You can correct the home and siteurl values in the WordPress options table. Create a database backup before editing any values.

How to Fix WordPress Admin Redirect Loop

Q: How can I disable plugins without accessing wp-admin?

Open File Manager or SFTP and rename wp-content/plugins to plugins-disabled. WordPress will stop loading the standard plugins without deleting their files or settings.

You enter the correct WordPress username and password, click Log In, and expect to reach the dashboard. Instead, WordPress sends you back to the login page. In some cases, the login page repeatedly refreshes, while others display an “ERR_TOO_MANY_REDIRECTS” or “The page isn’t redirecting properly” message.

This problem is commonly known as a WordPress admin redirect loop or WordPress login redirect loop.

The loop usually happens when WordPress cannot create or recognize your authentication cookie, the website URLs do not match, HTTP and HTTPS settings conflict, a plugin forces an incorrect redirect, or the server contains competing redirect rules.

This guide explains how to fix a WordPress admin redirect loop using browser troubleshooting, File Manager, phpMyAdmin, wp-config.php, server configuration, and WP-CLI. It also covers redirect problems that begin after an SSL installation, domain migration, plugin update, or hosting change.

TL;DR: Fastest WordPress Admin Redirect Loop Fixes

Try these steps in order:

Clear cookies and cached data for your domain.
Open the login page directly at https://example.com/wp-login.php.
Confirm that both the WordPress Address and Site Address use the same domain and protocol.
Temporarily disable all plugins by renaming wp-content/plugins.
Temporarily rename the .htaccess file.
Clear the WordPress, server, CDN, proxy, and browser caches.
Check whether HTTP and HTTPS redirects conflict.
Review the PHP and web server error logs.

If the loop started after enabling SSL, migrating the website, changing the domain, or placing WordPress behind Cloudflare or another proxy, begin by checking the stored website URLs and HTTPS detection.

What Is a WordPress Admin Redirect Loop?

A WordPress admin redirect loop occurs when the login or dashboard request is repeatedly redirected between two or more URLs.

A typical loop may look like this:

wp-admin
↓
wp-login.php
↓
wp-admin
↓
wp-login.php

Another common loop happens between HTTP and HTTPS:

http://example.com/wp-admin
↓
https://example.com/wp-admin
↓
http://example.com/wp-admin

You may also be redirected between the www and non-www versions:

https://example.com/wp-admin
↓
https://www.example.com/wp-admin
↓
https://example.com/wp-admin

The browser eventually stops following the redirects and displays an error because the website never reaches a final page.

The issue may appear in several ways:

The login page reloads after submitting valid credentials.
WordPress returns you to wp-login.php without showing an error.
The browser displays ERR_TOO_MANY_REDIRECTS.
The browser says the page is not redirecting properly.
You can view the website but cannot enter wp-admin.
The dashboard opens in one browser but not another.
Login works in a private window but fails in the normal browser.
WordPress repeatedly asks you to enable cookies.
The problem only affects users with administrator privileges.
The loop started after enabling HTTPS or changing the domain.

What Causes the WordPress Admin Redirect Loop?

The most common causes include:

Expired or corrupted browser cookies
A mismatch between the WordPress Address and Site Address
An HTTP and HTTPS configuration conflict
A www and non-www domain mismatch
An incorrectly configured caching plugin
Cached login pages at the server or CDN level
A security, membership, redirect, or login plugin conflict
Incorrect COOKIE_DOMAIN settings
Conflicting rules in .htaccess
Incorrect NGINX redirect rules
Cloudflare Flexible SSL or proxy configuration problems
A failed domain migration
Incorrect reverse proxy headers
Wrong file permissions or ownership
A damaged WordPress core file
An incorrect multisite domain or cookie configuration

Before You Begin

Create a backup of the website files and database before editing configuration files, database values, or server rules.

At minimum, back up:

The wp-config.php file
The .htaccess file
The complete wp-content folder
The WordPress database

You can usually create a backup through your hosting dashboard, cPanel, DirectAdmin, Plesk, phpMyAdmin, a backup plugin, or a server snapshot.

Method 1: Clear Cookies for Your WordPress Website

WordPress uses authentication cookies to confirm that you are logged in. If these cookies are expired, blocked, corrupted, or created for the wrong domain, WordPress may accept your credentials but immediately send you back to the login page.

Clearing the cookies for your website is the fastest and safest first step.

Clear Cookies for Only Your Domain

Instead of deleting all browser data, remove the cookies associated with your WordPress domain.

After clearing them:

Close every tab containing your website.
Open a new browser tab.
Visit the direct WordPress login URL.
Enter your username and password again.

https://example.com/wp-login.php

Replace example.com with your actual domain.

Test in a Private Browsing Window

Open the login page in an incognito or private browsing window.

If login works there, the problem is probably related to browser cookies, cached redirects, or a browser extension.

Check Whether Cookies Are Enabled

WordPress cannot maintain your login session when browser cookies are disabled.

Confirm that:

Cookies are enabled for your website.
Your browser is not blocking all third-party and site-specific cookies incorrectly.
A privacy extension is not deleting cookies immediately.
The domain is not included in a browser cookie-blocking list.

Method 2: Clear Every Cache Layer

A redirect may continue even after you correct the underlying problem because the old response remains cached.

Clear all applicable caches:

Browser cache
WordPress caching plugin cache
Hosting or server cache
NGINX FastCGI cache
LiteSpeed cache
Varnish cache
Redis or Memcached object cache
Cloudflare or another CDN cache
Reverse proxy cache
PHP OPcache, when necessary

The WordPress login page and admin area should not normally be served from a public full-page cache.

Make sure these paths are excluded from page caching:

/wp-admin/*
/wp-login.php

Requests containing WordPress authentication cookies should also bypass page caching.

Method 3: Confirm the WordPress Address and Site Address

WordPress stores two important website URLs:

WordPress Address: The location of the WordPress application files.
Site Address: The public address visitors use to access the website.

For a typical WordPress installation in the main domain directory, both values should be identical.

https://example.com

A mismatch can make WordPress create cookies for one domain or protocol while redirecting the browser to another.

Common URL Mismatches

Problematic combinations include:

http://example.com
https://example.com

https://www.example.com
https://example.com

https://example.com
https://example.com/wordpress

Choose one canonical version of the domain and use it consistently.

Method 4: Set the Site URLs in wp-config.php

If you cannot access the dashboard, you can temporarily define the website URLs in wp-config.php.

Open your hosting File Manager or connect through SFTP.
Open the WordPress installation directory.
Edit wp-config.php.
Add the following lines above the stop-editing comment.

define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );

Add them above:

/* That's all, stop editing! Happy publishing. */

Replace example.com with your correct domain.

Use either the www or non-www version consistently. Do not include a trailing slash.

For example, do not mix:

define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://www.example.com' );

After saving the file:

Clear browser cookies.
Clear all website and CDN caches.
Open wp-login.php directly.
Test the login again.

Method 5: Correct the Site URLs Through phpMyAdmin

You can also update the WordPress URLs directly in the database.

Open phpMyAdmin from your hosting control panel.
Select the WordPress database.
Open the options table.
Find the siteurl and home rows.
Set both to the correct website address.

The table is commonly named:

wp_options

Your website may use a custom prefix, such as:

abc_options

Both values should normally look like:

https://example.com

Do not add a trailing slash unless your configuration specifically requires one.

Update the URLs With an SQL Query

Advanced users can run:

UPDATE wp_options
SET option_value = 'https://example.com'
WHERE option_name IN ('siteurl', 'home');

Replace wp_ with the actual table prefix and replace the example domain with your own.

Create a database backup before running an SQL query.

Method 6: Disable All WordPress Plugins

Security, caching, redirect, SSL, membership, maintenance, and login customization plugins can create redirect loops.

If you cannot access the dashboard, disable all plugins through File Manager.

Open File Manager.
Go to public_html/wp-content/.
Find the plugins folder.
Rename it to plugins-disabled.
Clear all caches and cookies.
Try logging in again.

Original path:

public_html/wp-content/plugins

Temporary name:

public_html/wp-content/plugins-disabled

If the login works, one of the plugins is responsible.

Identify the Plugin Causing the Redirect

Rename plugins-disabled back to plugins.
Open the folder.
Rename one individual plugin folder at a time.
Clear cache and test the login after each change.

Start with plugins related to:

SSL and HTTPS
Security and firewalls
Login URL customization
Redirection
Caching and optimization
Memberships and user roles
Two-factor authentication
Maintenance mode
Single sign-on
Domain mapping

Keep the faulty plugin disabled until you can update, reconfigure, replace, or report it to the developer.

Method 7: Check Must-Use Plugins and Drop-In Files

Renaming the standard plugins folder does not disable must-use plugins or WordPress drop-in files.

Check for this directory:

wp-content/mu-plugins/

Temporarily rename it:

mu-plugins-disabled

You should also inspect these optional drop-in files:

wp-content/advanced-cache.php
wp-content/object-cache.php
wp-content/db.php
wp-content/sunrise.php

Temporarily rename one file at a time and test the login.

For example:

advanced-cache.php
advanced-cache.php-disabled

These files may be used by caching, database, multisite, security, or hosting-management systems. Do not permanently delete them unless you know which service created them.

Method 8: Rename the .htaccess File

On Apache and LiteSpeed servers, the .htaccess file may contain conflicting redirect rules.

Common causes include:

Duplicate HTTPS redirects
Conflicting www and non-www redirects
Old migration rules
Security plugin rules
Incorrect subdirectory redirects
Rules left behind by an uninstalled plugin

Test Without the Existing .htaccess File

Open the WordPress root directory.
Enable the option to display hidden files.
Find .htaccess.
Rename it to .htaccess-old.
Clear cookies and cache.
Test the login page.

If login works, the old file contained a problematic rule.

Restore the Standard WordPress Rules

A standard single-site WordPress installation on Apache typically uses:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

After regaining access:

Go to Settings > Permalinks.
Keep the existing permalink structure selected.
Click Save Changes.

WordPress will attempt to regenerate its rewrite rules.

Do not use the standard root rules unchanged for a subdirectory installation or WordPress multisite network.

Method 9: Check for HTTP and HTTPS Conflicts

Redirect loops commonly appear after installing an SSL certificate or forcing HTTPS.

The website may have multiple systems attempting to enforce HTTPS:

WordPress settings
A WordPress SSL plugin
The hosting control panel
The .htaccess file
NGINX configuration
Cloudflare page or redirect rules
A load balancer
A reverse proxy

Using several HTTPS redirect methods simultaneously can create conflicting behavior.

Choose One Primary HTTPS Redirect Layer

Use a single, clearly defined redirect at the server, hosting, or proxy level where possible.

Then make sure the WordPress URLs also use:

https://example.com

Force SSL for the WordPress Dashboard

WordPress supports the following setting:

define( 'FORCE_SSL_ADMIN', true );

Add it to wp-config.php only when HTTPS is installed and working correctly.

Do not use this setting before the domain has a valid SSL certificate.

Method 10: Fix HTTPS Detection Behind a Reverse Proxy

A reverse proxy, load balancer, container platform, or CDN may terminate HTTPS before forwarding the request to the WordPress server over HTTP.

The visitor uses HTTPS, but WordPress may incorrectly believe the request is HTTP. WordPress redirects to HTTPS, while the proxy sends another internal HTTP request, causing an endless loop.

If your proxy sends the standard forwarded protocol header, the following configuration may help WordPress recognize HTTPS:

if (
    isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] )
    && strpos( $_SERVER['HTTP_X_FORWARDED_PROTO'], 'https' ) !== false
) {
    $_SERVER['HTTPS'] = 'on';
}

Add proxy-related code carefully in wp-config.php and only when your hosting or proxy environment uses the corresponding header.

Do not trust arbitrary forwarded headers on a server that is directly exposed to untrusted traffic. The proxy and web server should be configured securely.

Method 11: Check Cloudflare SSL Mode

A WordPress redirect loop can occur when Cloudflare is set to Flexible SSL while the origin server also forces HTTPS.

In Flexible mode:

The visitor connects to Cloudflare using HTTPS.
Cloudflare may connect to the origin using HTTP.
The origin redirects HTTP to HTTPS.
Cloudflare repeats the HTTP origin request.

This can create an endless redirect.

When the origin server has a valid SSL certificate, use a mode that encrypts the connection between Cloudflare and the origin, such as Full or Full (Strict), according to your certificate setup.

Also review:

Cloudflare Redirect Rules
Bulk Redirects
Configuration Rules
Always Use HTTPS
Automatic HTTPS Rewrites
Origin Rules
Page Rules created before the newer rules system

Remove duplicate rules that force different domain or protocol versions.

Custom cookie settings in wp-config.php can prevent WordPress from recognizing the login session.

Look for constants such as:

define( 'COOKIE_DOMAIN', 'example.com' );
define( 'COOKIEPATH', '/' );
define( 'SITECOOKIEPATH', '/' );
define( 'ADMIN_COOKIE_PATH', '/wp-admin' );

If these values were added manually and are incorrect, comment them out or remove them temporarily.

For most standard WordPress websites, manually defining the cookie paths is unnecessary.

A particularly common problem is setting the cookie domain to a domain that does not match the actual login URL.

For example, this may fail when visitors log in at the non-www domain:

define( 'COOKIE_DOMAIN', 'www.example.com' );

After changing cookie settings, delete the old browser cookies before testing again.

Method 13: Check the www and Non-www Versions

WordPress should consistently use either:

https://example.com

or:

https://www.example.com

It should not alternate between both.

Check the domain version in:

The home database value
The siteurl database value
WP_HOME
WP_SITEURL
The hosting redirect setting
The CDN redirect rules
The Apache or NGINX server configuration
Security and SSL plugins

Set one canonical version and redirect the other version to it only once.

A security plugin may change the default WordPress login path from:

/wp-login.php

to a custom address such as:

/secure-login/

If the plugin is disabled, updated, or misconfigured, the custom login path may redirect incorrectly.

Temporarily disable the login security plugin through File Manager and test:

https://example.com/wp-login.php

Also remove old bookmarks that point to a previous domain, subdirectory, HTTP address, or customized login slug.

Method 15: Switch to a Default WordPress Theme

A theme can create a login redirect through code in functions.php, a membership integration, or a custom authentication function.

To disable the active theme:

Open File Manager.
Go to wp-content/themes/.
Find the active theme folder.
Rename it by adding -disabled.

For example:

custom-theme
custom-theme-disabled

WordPress will attempt to use another installed theme.

Make sure an official default WordPress theme is available before disabling the active theme.

If login starts working, inspect the theme for:

wp_redirect() functions
wp_safe_redirect() functions
template_redirect hooks
login_redirect filters
Custom membership checks
Role-based dashboard restrictions
Custom HTTPS enforcement

Method 16: Enable WordPress Debug Logging

A redirect loop may not produce a visible PHP error, but debug logging can reveal plugin warnings, cookie problems, or failed redirect functions.

Edit wp-config.php and add:

define( 'WP_DEBUG', true );
define( 'WP_DEBUG_LOG', true );
define( 'WP_DEBUG_DISPLAY', false );
@ini_set( 'display_errors', 0 );

Add the code above:

/* That's all, stop editing! Happy publishing. */

Attempt to log in again and then check:

wp-content/debug.log

Look for recent entries related to:

Headers already sent
Failed session initialization
Cookie headers
A plugin or theme redirect function
Undefined constants
PHP warnings before cookie creation
Fatal errors during authentication

After troubleshooting, disable debug mode:

define( 'WP_DEBUG', false );
define( 'WP_DEBUG_LOG', false );
define( 'WP_DEBUG_DISPLAY', false );

Delete the debug log if it contains sensitive technical information.

Method 17: Check for “Headers Already Sent” Errors

WordPress must send authentication cookies through HTTP headers. Unexpected output sent before those headers can prevent cookies or redirects from working correctly.

The error log may show:

Cannot modify header information - headers already sent

Common causes include:

Blank spaces before the opening PHP tag
Output after a closing PHP tag
A Byte Order Mark in a PHP file
Debugging text printed by a plugin or theme
An echo, print_r, or var_dump statement
A damaged wp-config.php file

The error normally identifies the file and line where output began. Remove the unwanted output or restore a clean version of that file.

Method 18: Check File and Folder Permissions

Incorrect permissions or ownership can prevent WordPress from reading configuration files or writing session-related data.

Common WordPress permissions are:

Folders: 755
Files: 644
wp-config.php: 600 or 640, depending on the server

Do not set files or folders to 777. It creates a security risk and does not solve most redirect problems.

If correct permissions do not remain applied, contact the hosting provider and ask them to check file ownership.

Method 19: Reinstall the WordPress Core Files

Damaged or incomplete WordPress core files can interfere with authentication and redirects.

To replace the core files manually:

Download a clean WordPress package from the official WordPress website.
Extract the package on your computer.
Delete the extracted wp-content folder.
Upload the remaining files and folders to the website.
Allow the clean core files to replace the existing versions.

Do not overwrite:

Your live wp-content folder
Your live wp-config.php file

Your posts, pages, users, and settings are stored in the database, while themes, plugins, and uploads are located inside wp-content.

Method 20: Use WP-CLI

If your hosting account provides SSH and WP-CLI, you can troubleshoot the login loop from the command line.

Check the Stored URLs

wp option get home
wp option get siteurl

Update the URLs

wp option update home 'https://example.com'
wp option update siteurl 'https://example.com'

Deactivate All Plugins

wp plugin deactivate --all

Activate a Default Theme

wp theme activate twentytwentysix

Clear WordPress Cache

wp cache flush

Verify the WordPress Core Files

wp core verify-checksums

Run WP-CLI commands from the correct WordPress installation directory.

Fixing a Redirect Loop After Moving WordPress

A domain migration or hosting migration can leave old URLs inside the database, configuration files, cache, or server rules.

Check:

The home database value
The siteurl database value
WP_HOME and WP_SITEURL
Serialized plugin and theme settings
Old redirect rules
CDN settings
SSL configuration
Cookie constants
The DNS record and origin server

You can preview a WP-CLI search and replace operation with:

wp search-replace 'https://old-domain.com' 'https://new-domain.com' --all-tables --dry-run

If the preview is correct, run the command again without --dry-run:

wp search-replace 'https://old-domain.com' 'https://new-domain.com' --all-tables

Create a database backup before performing a search and replace.

Fixing a Redirect Loop After Changing the WordPress URL

If you changed the WordPress Address or Site Address and became locked out, restore both values through wp-config.php or phpMyAdmin.

Set both to the last known working address:

define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );

Then:

Delete browser cookies for the old and new domains.
Clear the hosting cache.
Purge the CDN cache.
Open the correct wp-login.php URL.

Fixing a Redirect Loop After Enabling SSL

When the problem begins immediately after enabling SSL:

Confirm that the SSL certificate is valid for the domain.
Set both WordPress URLs to HTTPS.
Remove duplicate HTTPS redirects.
Check Cloudflare or proxy SSL mode.
Clear all caches and browser cookies.
Disable SSL-related plugins temporarily.
Check whether WordPress correctly detects HTTPS.

A valid SSL certificate alone does not guarantee that every layer uses the same HTTPS configuration.

WordPress multisite has additional domain, path, and cookie settings that can cause login loops.

Review the network constants in wp-config.php:

define( 'MULTISITE', true );
define( 'SUBDOMAIN_INSTALL', false );
define( 'DOMAIN_CURRENT_SITE', 'example.com' );
define( 'PATH_CURRENT_SITE', '/' );
define( 'SITE_ID_CURRENT_SITE', 1 );
define( 'BLOG_ID_CURRENT_SITE', 1 );

Confirm that:

DOMAIN_CURRENT_SITE uses the correct domain.
The domain does not include http:// or https://.
PATH_CURRENT_SITE matches the network path.
Mapped domains have valid SSL certificates.
The network database tables contain the correct domains.
Cookie settings match the multisite structure.

Do not apply single-site database instructions blindly to a multisite network. Back up the complete network database before editing domain values.

What If wp-admin Redirects to the Homepage?

If visiting wp-admin sends you to the homepage instead of the login page, common causes include:

A security plugin hiding the login page
A maintenance or coming-soon plugin
A membership plugin restricting dashboard access
Custom redirect code in the theme
An incorrect user role
A server redirect targeting wp-admin

Disable plugins and switch to a default theme. Then inspect the server rules for redirects involving:

wp-admin
wp-login.php
admin
login

Immediate logout is usually related to cookies, URL mismatches, or server time.

Check:

The browser cookie settings
The WordPress and Site Address values
The domain’s www or non-www version
The HTTP or HTTPS protocol
Custom cookie constants
The server date and time
Security plugins
Reverse proxy headers

Authentication cookies can be considered invalid when the server clock is significantly incorrect. Ask the hosting provider to verify the system time and time synchronization.

What If Only One Administrator Is Affected?

If other administrators can log in, the website-wide redirect configuration may be working correctly.

The affected user may have:

Corrupted user metadata
An incorrect role or capability
A security lockout
A forced password reset requirement
A two-factor authentication problem
Browser-specific cookie corruption

Test the account in another browser and network. Another administrator can also check the user’s role and reset the password.

What If the Website Works but wp-admin Shows Too Many Redirects?

When only the dashboard is affected, focus on admin-specific behavior:

FORCE_SSL_ADMIN
Admin cookie paths
Security plugins
Login URL plugins
Dashboard restrictions
Reverse proxy HTTPS detection
Cached wp-login.php responses

The public website and dashboard may pass through different cache rules, security policies, or HTTPS redirects.

How to Prevent Future WordPress Redirect Loops

Use One Canonical Domain

Choose either the www or non-www version and use it consistently in WordPress, hosting, CDN, analytics, and redirect settings.

Use HTTPS Consistently

Set both WordPress URL values to HTTPS after installing a valid SSL certificate. Avoid running conflicting HTTPS plugins and server rules.

Exclude wp-login.php, wp-admin, and authenticated user sessions from public page caching.

Test Changes in Staging

Test migrations, SSL changes, security plugins, caching configurations, and redirect rules on a staging website before applying them to production.

Keep Configuration Backups

Save working copies of:

wp-config.php
.htaccess
NGINX virtual host configuration
CDN redirect rules
Database backups

Avoid Duplicate Redirect Systems

Do not force the same redirect independently through WordPress, a plugin, hosting, Cloudflare, Apache, and NGINX without understanding how the rules interact.

Review Redirects After a Migration

Remove old domain, subdirectory, HTTP, and temporary staging redirects after completing a website migration.

WordPress Admin Redirect Loop Troubleshooting Checklist

Clear cookies for the website.
Test the login in a private browser window.
Visit wp-login.php directly.
Clear WordPress, server, CDN, and proxy caches.
Confirm that cookies are enabled.
Check the home and siteurl values.
Check WP_HOME and WP_SITEURL.
Use one consistent HTTP or HTTPS protocol.
Use one consistent www or non-www version.
Disable all standard plugins.
Disable must-use plugins and drop-ins.
Switch to a default theme.
Rename and regenerate .htaccess.
Review Apache or NGINX redirect rules.
Check Cloudflare SSL and redirect settings.
Check reverse proxy HTTPS detection.
Remove incorrect cookie constants.
Enable WordPress debug logging.
Check for headers-already-sent errors.
Verify file permissions and ownership.
Verify or reinstall WordPress core files.
Review multisite domain settings when applicable.
Ask the hosting provider to inspect server-level redirects.

Frequently Asked Questions

WordPress usually redirects back to the login page when it cannot create or validate the authentication cookie. Common causes include corrupted cookies, mismatched website URLs, HTTP and HTTPS conflicts, caching, or a plugin redirect.

How do I fix a WordPress wp-admin redirect loop?

Clear the website cookies and cache, confirm that the WordPress and Site Address values match, disable plugins, rename the .htaccess file, and check for conflicting HTTPS or domain redirects.

Why does wp-admin show too many redirects?

The error occurs when the browser is repeatedly redirected between URLs. WordPress commonly loops between HTTP and HTTPS, www and non-www domains, the login page and dashboard, or the origin server and a reverse proxy.

Yes. Security, caching, SSL, redirection, membership, login customization, and two-factor authentication plugins can interfere with login cookies or redirect rules.

How can I disable plugins without accessing wp-admin?

Open File Manager or SFTP and rename wp-content/plugins to plugins-disabled. WordPress will stop loading the standard plugins without deleting their files or settings.

Can Cloudflare cause a WordPress redirect loop?

Yes. An incompatible SSL mode, duplicate redirect rule, or incorrect origin configuration can cause Cloudflare and the WordPress server to redirect requests repeatedly.

Should WP_HOME and WP_SITEURL be the same?

They are normally identical when WordPress is installed in the domain’s main directory. They may differ when the WordPress application files are intentionally stored in a separate subdirectory.

Will clearing cookies log me out of WordPress?

Yes. Clearing the website’s authentication cookies ends the current session, but it does not delete your WordPress account, content, or password.

Can an SSL certificate cause wp-admin redirects?

The certificate itself does not normally cause the loop. The problem usually comes from inconsistent HTTP and HTTPS settings or multiple systems attempting to force HTTPS differently.

Why can I log in through incognito mode but not my normal browser?

Your normal browser profile probably contains an expired cookie, cached redirect, or extension that interferes with authentication. Clear the website’s cookies and cache and temporarily disable privacy or security extensions.

Yes. You can correct the home and siteurl values in the WordPress options table. You should create a database backup before editing any values.

What should I do if none of the fixes work?

Ask your hosting provider to inspect the Apache or NGINX configuration, reverse proxy headers, SSL termination, server cache, file ownership, and redirect logs. Provide the affected URL and explain when the loop started.

Final Thoughts

A WordPress admin redirect loop usually comes from a cookie, URL, cache, HTTPS, plugin, or server configuration mismatch. Begin with the simplest fixes by clearing cookies and cache, opening wp-login.php directly, and confirming the WordPress website URLs.

If the loop continues, disable plugins, test the theme, rename .htaccess, and inspect HTTPS redirects across WordPress, your hosting server, and CDN. Websites using Cloudflare, containers, load balancers, or reverse proxies also need correct HTTPS detection.

After restoring dashboard access, use one canonical domain, exclude login sessions from page caching, remove duplicate redirects, and test future SSL or migration changes in a staging environment.

If your website displays a fatal PHP message instead of a redirect loop, follow our guide on fixing a WordPress critical error without a recovery email.

WordPress Admin Redirect Loop: How to Fix wp-admin Login Redirects