WordPress login redirect loop: the password works, then you are back at the login page

What is a WordPress login redirect loop?

A WordPress login redirect loop is when you type the right password, the login form takes it, and you land on the login page again. No error, or an error that blames your browser.

WordPress did log you in and set a login cookie. The dashboard did not see that cookie, so it sent you back. The fix is to find out where the cookie went.

Getting people back into wp-admin, on a staging copy first so the live site stays up, is part of our WordPress maintenance work.

How did we test it?

On 17 Oct 2026 we set up WordPress 7.1.3 on PHP 8.3.33 in WordPress Playground, with the site address set to http://127.0.0.1. We logged in through the normal wp-login.php form with curl, kept the cookies in a jar the way a browser would, and then opened /wp-admin/.

A good login answered 302 to /wp-admin/ and set 4 cookies, and the dashboard then answered 200.

Why does logging in at a different address loop?

We opened the same site as http://localhost in place of http://127.0.0.1. Both reach the same server, the way example.com and www.example.com often do.

The login form took the password and set its 4 cookies for localhost. Then it sent us to the dashboard at the site address, 127.0.0.1. WordPress sets its login cookies for one host name only, and they are not sent to another, so the dashboard saw no login and answered 302 to wp-login.php with reauth=1.

In our lab a second login, on the page WordPress sent us to, worked. If yours fails again, something keeps moving you to the other name, such as a rule that adds or drops www.

Can one line in wp-config.php cause the loop?

Yes. We added define( ‘COOKIE_DOMAIN’, ‘www.example.test’ ) to wp-config.php, a domain the site was not on.

Every cookie WordPress sent now carried domain=www.example.test, and our client refused all 4, as browsers do. The login page answered 200 with “Error: Cookies are blocked or not supported by your browser. You must enable cookies to use WordPress.” Opening /wp-admin/ sent us back to the login page.

We took the line out and the same login answered 302, then 200.

The wp-config.php handbook, read on 18 Oct 2026, says the cookie domain is for “those with unusual domain setups”, and its example is a site that serves static files from a subdomain. If your site has no setup like that, it may not need the line at all.

Does “Cookies are blocked” mean the browser is the problem?

Not on its own. We also sent the login with no cookie jar at all, like a browser with cookies switched off. The page gave the same error, word for word.

So the message cannot tell the two apart. Try a second browser. If one logs in and the other does not, check that browser’s cookie settings. If every browser gets the error, look at wp-config.php.

How do you fix a WordPress login redirect loop?

Work from the cheapest check to the deepest:

1. Note the address you log in at, then compare it with the WordPress Address and Site Address under Settings, General. Log in at that exact address, with or without www to match.
2. If you can’t reach Settings, open wp-config.php and look for COOKIE_DOMAIN, COOKIEPATH, WP_HOME and WP_SITEURL lines. A cookie domain that does not match the site is a likely cause.
3. Try a private window and a second browser to rule out the browser itself.
4. If a cache plugin or CDN is in front of the site, make sure wp-login.php and wp-admin are not cached. We did not test this one.

If the login loop started after someone changed the site address, our post on getting back in after a WordPress site URL change has the wp-config.php steps.

We fix this as a single job. On a staging copy we trace where the login cookie goes, change the one address setting or wp-config.php line at fault, and hand back a login that holds.

What if the browser says too many redirects?

That is a different loop, one that never shows a login form. Our write-up of four redirect loops we reproduced covers the https and www rules behind it.

What did we not test?

• Real browsers. We sent every request with curl and a cookie jar, which follows the same host and domain rules for cookies.
• http and https mixed up, and a host or server rule that adds or drops www.
• A cache plugin or CDN serving a cached login page or dashboard.
• Security plugin login rules, multisite and changed secret keys.

Are you stuck at the login page right now?

Tell us the address you log in at and what the page says after you log in, and we will say where the cookie is going.

Want the whole site checked? Send your site address for the free site check, and a written reply comes within 2 business days. If you already know what needs doing, see our one-off WordPress fixes.