Because WordPress relies entirely on cookies for login sessions, corrupted cookies are the single most common cause of login loops. This is always the first fix to try — it takes 30 seconds and resolves the problem more often than you'd expect.

Clear WordPress cookies specifically:

• Chrome: Settings → Privacy and Security → Clear browsing data → Cookies and other site data
• Firefox: Settings → Privacy & Security → Clear Data → Check both "Cookies" and "Site data"
• Safari: Preferences → Advanced → Enable Develop menu → Manage Website Data → Remove All

Test in a private/incognito window — This bypasses cookies entirely.

Test in a completely different browser — If you can log in successfully in a fresh browser (e.g., Edge or Brave) but it loops in Chrome or Firefox, it's definitively a browser issue.

A mismatch between your WordPress Address (URL) and Site Address (URL) is the second most common cause of login loops. WordPress uses these two URLs to construct the redirect path after login.

Fix via WordPress admin (if accessible):

1. Go to Settings → General
2. Check both WordPress Address (URL) and Site Address (URL)
3. Make sure both are identical and match your actual domain exactly — including http:// vs. https:// and www vs. non-www
4. Click Save Changes

Fix via wp-config.php (if locked out):

Edit wp-config.php via FTP and add these two lines just before the /* That's all, stop editing! */ comment:

define( 'WP_HOME', 'https://yourdomain.com' );
define( 'WP_SITEURL', 'https://yourdomain.com' );

Replace https://yourdomain.com with your actual domain. Save the file and try logging in again.

Security plugins, caching plugins, and membership plugins are frequent causes of login loops because they intercept login requests. A plugin conflict can redirect post-login requests to a wrong URL or block session cookies.

The Fix — Disable all plugins via FTP:

1. Connect to your server via FTP
2. Navigate to /wp-content/plugins/
3. Rename the plugins folder to plugins_disabled
4. Reload your site. If you can now log in, a plugin was the cause

If you can log in, re-enable plugins one at a time, testing after each one, until you find the culprit.

Common plugins that cause login loops:

• Wordfence: Aggressive firewall rules can block login access
• iThemes Security: Login protection features can sometimes misfire
• WP Rocket: Caching can conflict with session management
• BuddyPress: Can block admin area login

A corrupted .htaccess file with conflicting redirect rules is a common culprit — especially when mixed with SSL redirect rules or caching rules.

Check for conflicting redirect rules:

Open your .htaccess file via FTP and look for blocks like this:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^wp-login.php$ - [R,L]

This rule forces /wp-login.php to redirect. If placed incorrectly or combined with a conflicting cache plugin rule, it can lock you into the loop.

Reset your .htaccess file:

1. Rename it to .htaccess_old via FTP
2. Go to Settings → Permalinks in WordPress and click Save Changes

WordPress will generate a fresh, clean .htaccess file. Test your login again.

If your site recently moved to HTTPS and the login loop started then, your server configuration is likely the culprit.

Check your server settings:

Contact your hosting provider and ask them to check if your server configuration allows correct handling of WordPress login requests.

Clear .htaccess SSL conflicts:

Check your .htaccess for double redirect rules or legacy code conflicting with WordPress's core login logic.

Verify your URL settings:

Make sure your WordPress Address and Site Address in Settings → General both use https://.

WordPress login redirects can be caused by database corruption of user roles — specifically the Administrator or Editor roles. If these roles are missing or capabilities like read are removed, WordPress doesn't recognize you as an admin and sends you back to the login page.

Fix via WordPress admin (if accessible):

1. Go to Users → All Users
2. Edit the problem user
3. Set the role to Administrator and click Update User

Fix via database directly (Advanced):

-- Check current user capabilities
SELECT meta_value FROM wp_usermeta 
WHERE user_id = 1 AND meta_key = 'wp_capabilities';

-- Restore admin capabilities
UPDATE wp_usermeta 
SET meta_value = 'a:1:{s:13:"administrator";b:1;}' 
WHERE user_id = 1 AND meta_key = 'wp_capabilities';

Once updated, clear your cookies and try logging in again.

In severe cases — especially after a malware attack or a bad plugin update — WordPress user tables can be modified to downgrade admins or restrict their capabilities.

-- Check all meta for a specific user
SELECT * FROM wp_usermeta WHERE user_id = 1;

-- Check user level (legacy)
SELECT meta_value FROM wp_usermeta 
WHERE user_id = 1 AND meta_key = 'wp_user_level';

If admin capabilities are missing or corrupted, restore them:

• Restore from a backup: Use UpdraftPlus, BlogVault, or your host's backup tool to restore your database
• Fix manually: Use the SQL query from Fix 6 to restore administrator capabilities