WordPress Login Not Working? Fix the wp-admin Redirect Loop

12 min read

Share
A login form inside a circular arrow loop with a key and a shield

When WordPress login stops working, it usually looks like one of these:

  • you enter the right username and password, and the page reloads back to the login form;
  • /wp-admin keeps sending you to the login page and back again, and the browser finally says "too many redirects";
  • /wp-login.php or /wp-admin shows a 404 page, a 403 Forbidden, or redirects to the home page.

The cause is almost always one of a few things: a plugin that changed or hid the login URL, a redirect or SSL setting that sends you in circles, wrong site URLs in the database, or a hack that dropped .htaccess files or changed users. This guide follows the order I check them in, starting with the fastest way back into the dashboard.

Quick checklist: WordPress login not working

  1. Try a private window, clear cookies for the site, and try again (Step 1).
  2. Log in from cPanel with WP Toolkit or Softaculous (Step 2).
  3. Login URL changed or hidden by a plugin? Rename that plugin's folder (Step 3).
  4. Check for redirect, SSL and security plugins, and disable them the same way (Step 4).
  5. Check siteurl and home in wp_options, and the admin user in wp_users (Step 5).
  6. Fix SSL / Cloudflare loops (Step 6).
  7. Look for hacked .htaccess files in many folders, and clean them (Step 7).
  8. Still stuck? Restore the last good backup (Step 8).

Step 1: Rule out cookies and cache

WordPress needs a login cookie. If an old cookie is broken, or the browser has a cached redirect, you can loop even when nothing is wrong on the server.

  • Open the login page in a private / incognito window.
  • Or clear cookies and cached files for this site only.
  • Make sure you use the same address the site uses: https://www.example.com/wp-admin and https://example.com/wp-admin are different sites for cookies.

If the private window works, it was the browser. If it loops there too, continue.

Step 2: Log in directly from cPanel

Before fixing anything, get into the dashboard if you can. Most cPanel hosts have a one-click login that skips the normal login page:

  • WP Toolkit: in cPanel open WP Toolkit, expand the site, and click Log in next to the admin user.
  • Softaculous: open WordPress Manager by Softaculous (or Softaculous > All Installations), find the site, and click the admin / login icon.

Because you are already signed in to cPanel, you land straight in the WordPress dashboard. In my experience this works even when a plugin has hidden the login URL, so it is the quickest way to get in and turn that plugin off properly.

This only works if the site was installed with that tool, or was added to it (both can scan for existing installations). If the button is missing or it still loops, use the steps below.

Step 3: Login URL changed by a plugin? Disable it from cPanel

This is a case I dealt with recently. Someone had installed a plugin like WPS Hide Login to change the login address from /wp-admin and /wp-login.php to a random name like /my-door-7xq. Nobody wrote the new address down. Now /wp-admin showed a 404 page, and the real login page could not be found.

Plugins that change the login URL include WPS Hide Login, Solid Security (iThemes) "Hide Backend", All-In-One Security "Rename Login Page", Perfmatters, and several others.

Option A: Find the login slug in the database

WPS Hide Login stores the custom address in the database. In cPanel, open phpMyAdmin, select the site's database, open the wp_options table (your prefix may differ), and search for the option whl_page. Its value is the login slug: if it says my-door-7xq, log in at https://example.com/my-door-7xq.

Other plugins store it under their own option name, so this is quicker only if you know which plugin it is.

Option B: Disable the plugin by renaming its folder

This works for any plugin, without logging in:

  1. In cPanel, open File Manager and go to public_html/wp-content/plugins/.
  2. Find the plugin's folder, for example wps-hide-login.
  3. Rename it, for example to wps-hide-login-off.
  4. Now go to https://example.com/wp-login.php. WordPress cannot load the plugin, so the normal login is back.

After you are in, go to Plugins: WordPress shows the plugin was deactivated because its files were missing. Rename the folder back, activate it again if you still want it, and save the new login URL somewhere safe (a password manager is ideal).

Step 4: Disable redirect, SSL and security plugins

If the login page loads but keeps sending you back to itself, or to the home page, a plugin is often redirecting you. Common ones:

  • Redirect plugins (Redirection, 301 redirect plugins) with a rule that matches /wp-admin or /wp-login.php;
  • Login redirect plugins (LoginWP and similar) that send users to a page after login;
  • SSL plugins like Really Simple SSL, when the server's HTTPS setup does not match (Step 6);
  • Security plugins (Wordfence, Solid Security, All-In-One Security) with login protection, two-factor, country blocking or a lockout of your IP;
  • WooCommerce or membership plugins that redirect users to "My Account" instead of the dashboard;
  • Caching plugins that cached the login page or the dashboard.

Disable them the same way as in Step 3: rename the plugin's folder in File Manager, then try to log in. Clear the plugin's cache folder too (for example wp-content/cache) if a caching plugin was active.

If disabling plugins does not help, rename the active theme's folder in wp-content/themes/. WordPress falls back to a default theme, which rules out login redirects added in the theme's functions.php.

Step 5: Check the site URL and the user in the database

siteurl and home in wp_options

If the site address in the database is wrong, WordPress sends you to the wrong place after login, and you loop. This happens after a migration, a move from http to https, or switching between www and non-www.

  1. In phpMyAdmin, open the wp_options table (with your prefix).
  2. Find the rows siteurl and home (usually the first two rows).
  3. Both must be the exact live address, for example https://example.com: correct https, correct www or not, no trailing slash, and no old domain or temporary URL.
  4. Fix them, save, clear cookies and log in again.

Also open wp-config.php and look for WP_HOME and WP_SITEURL. If they are set there, they override the database, so they must be correct too.

The user in wp_users

If the login says the username or password is wrong, or you suspect a hack, check the users:

  1. Open wp_users. Your admin user should be there, with the right email. Look for users you do not recognise: attackers often add their own admin.
  2. To reset the password, edit your user, and in user_pass choose the function MD5 and type a new password. Save. WordPress converts it to a stronger hash at the next login.
  3. To check the role, open wp_usermeta, find your user_id with the meta_key wp_capabilities (with your prefix). For an admin it contains administrator. A hack sometimes downgrades the real admin's role.
🔐
Password GeneratorStrong random passwords and passphrases, with strength shown in bits

After you get in, delete any unknown admin users, and change the passwords of all admins.

Step 6: Fix SSL and Cloudflare redirect loops

A loop between http and https is one of the most common reasons for "too many redirects" on wp-admin.

  • Cloudflare "Flexible" SSL: visitors use HTTPS to Cloudflare, but Cloudflare talks to your server over plain HTTP. If WordPress or .htaccess then forces HTTPS, it redirects forever. Fix: in Cloudflare, set SSL/TLS to Full or Full (strict), after installing a free SSL certificate on the hosting (how to install free SSL in cPanel).
  • HTTPS forced in several places: a rule in .htaccess, an SSL plugin, a hosting "Force HTTPS" switch and Cloudflare's "Always use HTTPS" can fight each other. Keep one place that forces HTTPS.
  • FORCE_SSL_ADMIN with http URLs: if wp-config.php has define( 'FORCE_SSL_ADMIN', true ); but siteurl and home still start with http://, WordPress jumps between the two. Make the URLs https:// (Step 5).
  • Behind a proxy: if the site is behind Cloudflare or a load balancer and WordPress does not "see" HTTPS, this snippet in wp-config.php (above That's all, stop editing) tells it the visit is secure:
if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https' ) {
    $_SERVER['HTTPS'] = 'on';
}

Use it only when the site really is behind such a proxy.

Step 7: Hacked site? Clean the .htaccess files

If /wp-admin or /wp-login.php gives 403 Forbidden or a strange redirect, and you did not install anything, check for a hack. A common attack drops a .htaccess file into almost every folder (sometimes hundreds or thousands of them). These files block PHP everywhere except a short list of allowed files, so WordPress breaks and the login is blocked, while the attacker's own files keep working.

A typical bad file looks like this:

<FilesMatch ".(py|exe|php)$">
 Order allow,deny
 Deny from all
</FilesMatch>
<FilesMatch "^(index.php|lock360.php|wp-login.php)$">
 Order allow,deny
 Allow from all
</FilesMatch>

Signs: .htaccess files in wp-admin, wp-includes, wp-content, plugin and upload folders, often with the same date and size. A clean WordPress has no .htaccess in wp-admin or wp-includes.

Removing hundreds of files by hand in File Manager is not practical. What I do is let a small PHP script do it: upload it to the main folder, open it in the browser, and it goes through every folder and cleans the .htaccess files in one run.

Ask an AI to write the cleanup script for you

Every hosting setup is a little different, so instead of copying a fixed script from a blog, I ask an AI assistant (ChatGPT, Claude, Gemini or similar) to write one for my case. Copy one of the bad .htaccess files from your site and use a prompt like this:

My WordPress site is hacked. Almost every folder has a .htaccess file like this one:

[paste the content of one infected .htaccess file here]

Write a single PHP script I can upload to public_html and run in the browser. It should:
- search all folders and subfolders for .htaccess files that match this pattern;
- skip the main .htaccess in public_html;
- first only LIST the files it finds, and rename them only when I add &clean=1 to the URL;
- rename them to .htaccess.infected instead of deleting them;
- only run when a secret key is in the URL;
- print a summary at the end.

Then:

  1. Take a backup of the files first (cPanel Backup or a zip of public_html in File Manager).
  2. Save the script with a random file name, like clean-ht-82kd.php, upload it to public_html (the folder with wp-config.php), and open it in the browser with your key, for example https://example.com/clean-ht-82kd.php?key=your-key.
  3. Check the list. When it looks right, run it again with &clean=1 to clean.
  4. Open File Manager (turn on Show Hidden Files in Settings) and check a few folders: the bad .htaccess files should be gone.

If the script does not run or does not find the files, do not give up: copy the exact error message or the script's output back to the AI and ask it to fix the script, or to write a different version. Typical problems are a timeout on very large sites (ask it to process one folder at a time), a PHP version error, or a pattern that does not match your files exactly (paste a second infected file). Keep going until a run finds no more infected .htaccess files.

When you are done, delete the script from the server. Anyone who finds it could run it.

Then fix the main .htaccess

Open the .htaccess in public_html. Compare it with a backup copy if you have one (a diff checker shows every changed line), and remove anything you do not recognise, such as redirects to strange domains or blocks on wp-login.php. If unsure, replace it with the default WordPress rules:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

Cleaning the .htaccess files is not the end

The .htaccess files are only the symptom. Hacks like this usually leave a hidden PHP file that recreates them, sometimes within minutes. If they come back:

  • look for unknown PHP files in the main folder, wp-content, uploads and plugin folders (often with names that look like WordPress files, or files like lock360.php);
  • reinstall WordPress core files from a clean download (keep wp-content and wp-config.php), and reinstall plugins and themes from their official sources;
  • check wp_users for unknown admins (Step 5);
  • change all passwords: cPanel, FTP, database, every WordPress admin, and update the salt keys in wp-config.php;
  • run a malware scanner (your host may offer Imunify360 or a similar scanner in cPanel), and ask the host to scan the account.

If the site keeps getting reinfected, restoring a clean backup (next step) is often faster and safer than chasing every file.

Step 8: Restore the last good backup

If nothing works, or the site was hacked and you are not sure it is clean, restore a backup from before the problem started:

Pick the most recent backup from when login still worked. After restoring a hacked site, still change all passwords and update everything, or the same hole is used again.

How to avoid getting locked out again

  • When you change the login URL with a plugin, save the new address in a password manager straight away.
  • Keep one place that forces HTTPS.
  • Keep off-site backups that you can restore without logging in.
  • Use strong, unique passwords and two-factor login for admins.
  • Keep WordPress, plugins and themes updated, and remove plugins you do not use.

If the login page itself shows "There has been a critical error", see my critical error guide, and for a 500 error on wp-admin, the 500 Internal Server Error guide.

Frequently asked questions

Why does wp-admin keep redirecting to the login page?

Usually because the login cookie is not accepted: a wrong siteurl or home (http vs https, www vs non-www), an SSL setup that loops, a caching plugin, or a redirect or security plugin. Check them in that order.

I forgot my custom login URL. How do I log in?

Log in with WP Toolkit or Softaculous from cPanel, or look for the slug in wp_options (WPS Hide Login uses whl_page), or rename the plugin's folder in wp-content/plugins so the normal wp-login.php works again.

How do I log in to WordPress without a password?

From cPanel with WP Toolkit > Log in or Softaculous, if the site is installed or scanned there. Otherwise reset the password in phpMyAdmin (wp_users, user_pass, function MD5).

Why do I get 403 Forbidden on wp-login.php?

A security plugin, a firewall rule (ModSecurity), or a hacked .htaccess file is blocking it. A .htaccess file inside wp-admin or wp-includes is a strong sign of a hack.

Can Cloudflare cause a WordPress login loop?

Yes, mainly with Flexible SSL. Install an SSL certificate on the hosting and switch Cloudflare to Full or Full (strict).

Found this useful? Share it with someone who runs a website.

Share this article