You enter the right username and password, and WordPress sends you straight back to the login page, with no error. Or /wp-admin keeps redirecting to wp-login.php?redirect_to=…&reauth=1. This is a login redirect loop: WordPress isn’t seeing the authentication cookie it just set. Here are the causes, from most to least common.

Different problem? “Too many redirects” on the whole site: see WordPress too many redirects.

1. Clear cookies and test in a private window

Stale cookies from an old URL, or an old session, are a common trigger. Clear cookies for the domain, or try a private or incognito window. If it works there, your browser was the problem.

2. Site URL mismatch (www vs non-www, HTTP vs HTTPS)

WordPress sets cookies for the domain in siteurl/home. If you log in at https://www.example.com but home is https://example.com (or the reverse), the cookie doesn’t match, and you loop.

cd /var/www/example.com
wp option get home
wp option get siteurl

Make both identical to the URL you actually use, and redirect the other variant in Nginx:

wp option update home 'https://example.com'
wp option update siteurl 'https://example.com'

Check wp-config.php for WP_HOME, WP_SITEURL or COOKIE_DOMAIN constants that disagree. See change the WordPress site URL.

3. HTTPS behind a proxy, load balancer or Cloudflare

If TLS ends at a proxy (Cloudflare, Nginx in front of Apache, a load balancer), PHP may think the request is HTTP. WordPress then sets non-secure cookies, or redirects wp-admin to HTTPS again and again (with FORCE_SSL_ADMIN). Tell WordPress about the original protocol, in wp-config.php, above “That’s all, stop editing”:

if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https' ) {
    $_SERVER['HTTPS'] = 'on';
}

And make sure the proxy sends the header (proxy_set_header X-Forwarded-Proto $scheme;). With Cloudflare, use SSL mode Full (strict), never Flexible. See WordPress SSL/HTTPS.

4. Cached login or admin pages

A page cache (plugin, Nginx FastCGI cache, Varnish, or a CDN “cache everything” rule) that caches wp-login.php or /wp-admin/ serves an old page, without your new session. Exclude:

  • /wp-admin/*, /wp-login.php, /wp-json/*;
  • requests with wordpress_logged_in_* cookies.

Then purge the cache. See Nginx FastCGI cache and WordPress CDN setup.

5. Plugins (security, redirects, membership)

Security plugins (login URL changers, 2FA, firewall), redirect plugins and membership plugins can all intercept the login. Disable plugins to test:

wp plugin deactivate --all
# log in; if it works, re-enable plugins one at a time
wp plugin activate plugin-a

No shell? Rename wp-content/plugins to plugins.off over SFTP, log in, rename it back, and re-activate plugins one by one.

Also try a default theme. A functions.php with a bad wp_redirect() can cause loops:

wp theme activate twentytwentyfive

6. Sessions, salts and server time

  • Changed security keys and salts log everyone out, which is expected. But a wp-config.php that generates new salts on every request (bad code) makes login impossible.
  • Server clock far off: cookies may be considered expired immediately. Check with timedatectl, and enable NTP. See NTP time sync with chrony.
  • Full disk: PHP can’t write session or cache data. See disk full troubleshooting.

7. Reset your password as a test

If you’re unsure the password is actually accepted, set a new one with WP-CLI:

wp user update admin --user_pass='new-strong-password'

See reset the WordPress admin password.

Checklist

Check Command or place
URL variants match wp option get home / siteurl
Proxy HTTPS detected X-Forwarded-Proto + snippet in wp-config.php
Login pages not cached cache plugin / FastCGI / CDN rules
Plugins wp plugin deactivate --all
Server time timedatectl
Disk space df -h

Related: WordPress hardening and WordPress debug mode.

  • WordPress
  • Troubleshooting
  • Login