WordPress login redirect loop

Symptoms

You enter your username and password on wp-login.php and instead of loading the dashboard the same login form comes back. Sometimes the address bounces between login and wp-admin and you never reach either. The site itself loads fine in the same browser. The loop is annoying, but it is almost always a redirect or cookie configuration error, not a hack.

What the loop pattern tells you

How to fix

1. Reset the cookie rule first, it is the most common cause. WordPress remembers you with a wordpress_logged_in_... cookie. If the domain you typed does not match the value stored in wp-config.php, or a security plugin locked the login path, the cookie never validates and the loop repeats. Clear that site's cookies, or open a private window, then retry. If the private window gets in, the cause is a stale cookie or an add-on.
2. Confirm the site URL matches the address bar. In the database, run:

SELECT option_value FROM wp_options WHERE option_name IN ('siteurl','home');

Both values must equal what you type in the browser, including https and the www variant. If the host changed without the domain changing, update both or run wp search-replace after a move.

1. Fix the HTTPS redirect. If the site uses a redirect plugin or a security plugin that forces HTTPS, and the browser lands here without the cookie, check the mismatch: the page is served over http but the redirect sends every request to https. Set all of them to one scheme.
2. Disable the redirect plugin temporarily. A forced login redirect plugin, or a "force HTTPS" plugin, can fight the core redirect. Deactivate it and retest. If the loop breaks, the plugin needs a config fix, not deletion.
3. Check the wp-config.php constants. Some hosts inject:

define('FORCE_SSL_ADMIN', true);

If HTTPS is not actually on the /wp-login.php page, this makes the login loop. Disable it while the SSL is misconfigured. If the loop only happens when the address in the browser uses www and the stored URL uses the bare domain (or the reverse), the mismatch is the cookie host. Add a COOKIE_DOMAIN that matches the hostname in the address bar:

define('COOKIE_DOMAIN', 'www.example.com');

When COOKIE_DOMAIN is unset, WordPress derives its cookie host from siteurl, so edit out the define and correct the URL settings instead if you would rather centralize on one canonical host.

1. Clear caches. Page cache, object cache, and CDN layers can serve a cached redirect. Purge them, and in the browser use a private window so the cached 301/308 does not replay.
2. Test the raw redirect chain. Run this in the loop browser:

curl -I --max-redirs 0 https://example.com/wp-login.php

You will see the first hop. Then note the value of Set-Cookie and the /wp-admin hop; a mismatch in the scheme or host at any hop is the smoking gun.

Prevention

• Set siteurl and home to one canonical address before moving a domain or enabling HTTPS, and test a private-window login after the swap.
• Avoid HTTPS, login, and security-redirect plugins doing overlapping jobs; one of them should not be forcing your login URL, and two of them should not be rewriting the same scheme.
• Treat a successful login in a private window as proof that DNS, SSL, and hostname are aligned across the whole site.