If /wp-admin/ or /wp-login.php loops, reloads, or sends you back to HTTP after you enabled HTTPS, work through the layers in order: confirm the TLS certificate and HTTPS virtual host, make the WordPress URL settings agree, tell WordPress when a proxy terminated HTTPS, clear login cookies, isolate plugins, and then replace remaining HTTP URLs. Changing every setting at once makes the cause harder to identify.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
The failure is usually a configuration mismatch rather than a lost administrator account. The steps below separate server, WordPress, proxy, browser, plugin, and database problems so you can restore access without blindly editing files or running an unsafe database-wide replacement.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsIdentify the symptom before changing anything
Note exactly what happens in a normal browser and in a private window. The visible behavior narrows the search:
| Visible symptom | Most likely layer | First checks | Typical fix |
|---|---|---|---|
| Every page, including the front end, alternates between HTTP and HTTPS or ends with “too many redirects.” | Canonical URL values or a reverse proxy that is not forwarding the original scheme | Compare WP_HOME, WP_SITEURL, the database home/siteurl, and the proxy’s forwarded-protocol header. |
Use one HTTPS canonical URL and configure the proxy-to-WordPress HTTPS signal. |
| The login form reloads after submitting credentials, or returns to the login form without an error. | Stale cookies, conflicting URL values, or a plugin changing authentication redirects | Test in a private window, clear site cookies, then disable plugins temporarily. | Remove old cookies, correct URL settings, and identify the conflicting plugin. |
The front end works, but /wp-admin/ does not. |
Login cookies, admin URL redirects, or a security/login plugin | Test /wp-login.php directly, inspect URL constants, and isolate plugins. |
Correct the URL scheme, clear cookies, and re-enable plugins one at a time. |
| The secure page loads but images, scripts, styles, or embeds are blocked or broken. | Stored http:// URLs and mixed content |
Use the browser developer console to identify the insecure requests. | Perform a carefully scoped serialized-data-safe search-and-replace, then fix hard-coded theme or CSS URLs. |
| The browser shows a certificate warning or cannot establish HTTPS at all. | Certificate, DNS, port 443, or HTTPS virtual-host configuration | Inspect the certificate for the exact hostname and verify that the web server is listening with that certificate. | Repair the TLS installation before changing WordPress settings. |
Also record whether the site is single-site or multisite, whether HTTPS ends directly at the web server or at a proxy/load balancer, and whether WP_HOME or WP_SITEURL are hard-coded. Those details change the safest repair path.
#1 Best Overall
1. Prove that HTTPS works at the server layer
Check the certificate and hostname
WordPress is fully compatible with HTTPS when a TLS/SSL certificate is installed and available for the web server to use. The certificate must cover the hostname visitors use, including the chosen www or non-www form. A certificate for one hostname does not automatically make another hostname valid.
- Open the HTTPS URL directly, not only an HTTP URL that is redirected.
- Confirm the browser reports a valid certificate chain and the expected hostname.
- Verify that DNS for the hostname points to the server or proxy that owns the certificate.
- Confirm the HTTPS virtual host is enabled and serves the intended WordPress document root.
- Make sure port 443 is reachable through the firewall or hosting platform.
If the HTTPS request lands in the wrong virtual host, WordPress may be running under a different site configuration. Fix the web-server or hosting configuration first; editing the database cannot repair a missing or misapplied certificate.
Check the redirect direction
There should be one deliberate canonical direction: HTTP requests may redirect to HTTPS, while HTTPS requests should be served as HTTPS without being redirected back to HTTP. A second rule in the web server, control panel, CDN, or security plugin can create a loop. Temporarily disable duplicate redirect rules while diagnosing, but keep a single HTTP-to-HTTPS policy once the site is working.
2. Make WordPress’s canonical URLs agree
Inspect wp-config.php
Open the active WordPress installation’s wp-config.php through your host’s file manager, SFTP, or SSH. Look for hard-coded constants:
define('WP_HOME', 'https://example.com');
define('WP_SITEURL', 'https://example.com');Use the real canonical hostname and, if WordPress is installed in a subdirectory, include that path in WP_SITEURL. Keep the values internally consistent: the same scheme, hostname, and installation path. Do not leave one constant on http:// while the other uses https://. Avoid adding a trailing slash to these URL values unless your existing configuration specifically requires it.
Constants in wp-config.php override the corresponding database options in the normal WordPress settings screen. If an old constant is forcing HTTP, changing Settings » General will appear to do nothing. Correct or remove the stale definition only after saving a backup of the file.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
Inspect the database values
In the database used by this installation, inspect the options table (often named wp_options, but the prefix may be different) and find the rows whose option names are home and siteurl. A read-only SQL check is:
SELECT option_name, option_value
FROM wp_options
WHERE option_name IN ('home', 'siteurl');Both values should point to the same intended HTTPS URL, with the correct hostname and installation path. If the table prefix is not wp_, substitute the actual prefix. In phpMyAdmin or another database tool, edit only these two rows when you have confirmed the value is wrong, and retain a database backup before making changes.
Account for multisite and hard-coded values
Multisite can store additional network and per-site URL values. A network’s main site, mapped domains, and individual site records must all use the correct HTTPS host and path. Do not assume that changing the main site’s two options repairs every site in the network. Work through the network’s URL settings and each affected site, and take a full database backup before editing.
If the URL values look correct but the loop remains, search wp-config.php, the server configuration, and deployment environment variables for another hard-coded HTTP URL. A hosting panel or container environment can reintroduce the old value on every request.
Recommended Free Tools
3. Tell WordPress when a proxy terminated HTTPS
Why a proxy causes an apparent contradiction
With a reverse proxy, CDN, or load balancer, the browser connects over HTTPS to the proxy, while the proxy may connect to the origin web server over HTTP. WordPress then sees an HTTP origin request and tries to redirect it to HTTPS, even though the browser is already using HTTPS. The result is an infinite redirect loop or a login cookie that never becomes valid.
The proxy must forward the original scheme, commonly in an X-Forwarded-Proto header, and WordPress must translate that trusted header into its HTTPS state. WordPress’s HTTPS guidance documents this pattern. Only trust the header from your known proxy; accepting arbitrary client-supplied forwarding headers can let an attacker spoof the scheme.
Use a narrowly scoped wp-config.php check
Place the proxy handling before WordPress loads (normally above the line that says to stop editing). Adapt the condition to the header format documented by your proxy:
if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && 'https' === $_SERVER['HTTP_X_FORWARDED_PROTO']) {
$_SERVER['HTTPS'] = 'on';
}Some proxies send a comma-separated list when requests pass through multiple layers. Use the proxy provider’s documented value and test it rather than copying a generic rule blindly. If your infrastructure uses a load balancer, configure it to preserve the original protocol and verify that the origin receives the expected header.
Run WP-CLI behind an HTTPS proxy
WP-CLI includes the --assume-https option for commands operating behind an HTTPS proxy. It makes command-line URL generation use HTTPS when the CLI process cannot observe the browser-facing scheme. Use it for the affected command rather than permanently forcing HTTPS in unrelated environments, and confirm the proxy configuration itself is correct.
4. Clear cookies and test the two login endpoints
Remove stale authentication cookies
After changing the scheme or hostname, old cookies can keep sending the browser through an invalid login state. WordPress recommends clearing site cookies when the login page keeps reloading. Delete cookies for the exact domain, close all tabs for that domain, and reopen a private window. If the site uses both www and the bare hostname, clear cookies for both.
Test direct URLs in a controlled order
- Open
https://example.com/wp-login.phpdirectly. - Submit the login form once and note whether the browser reloads, redirects to HTTP, or reaches the dashboard.
- Open
https://example.com/wp-admin/in the same private window. - Repeat the test from a second browser or device to distinguish a browser-only cookie problem from a server-side loop.
Do not repeatedly submit credentials while a loop is active. A clean private-window result usually points to stale browser state; failure in every browser means continue with URL, proxy, and plugin checks.
5. Isolate plugins without locking yourself out
Temporarily disable normal plugins
A security, redirect, caching, or login plugin may retain an HTTP redirect or alter cookie handling after the site URL changes. If you cannot reach the dashboard, use SFTP, SSH, or the hosting file manager to rename wp-content/plugins to a temporary name such as plugins.off. WordPress will treat the normal plugins as unavailable. Test the login again.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Rank #4
If access returns, restore the folder name and reactivate plugins one at a time, testing in a private window after each activation. The plugin activated immediately before the loop returns is the likely conflict. Update or reconfigure it for HTTPS, or replace it after checking its documentation.
Remember must-use plugins and caches
Renaming the ordinary plugins directory does not disable must-use plugins in wp-content/mu-plugins, host-level drop-ins, server caches, or a proxy’s redirect rules. If the loop continues with normal plugins disabled, inspect those layers and purge page or object caches after changing URL settings. Keep a record of each change so you can restore the original state.
6. Replace old HTTP URLs safely
Separate redirect errors from mixed content
Old http:// URLs stored in posts, widgets, theme settings, page-builder data, or options usually cause mixed-content warnings and blocked assets rather than the initial login loop. Fix the canonical URL and proxy behavior first. Then use the browser developer console on an affected HTTPS page to list remaining insecure requests.
Back up before a database migration
Export a restorable copy of the database and, if possible, test the replacement on a staging copy. A URL replacement can affect serialized PHP data, JSON, shortcodes, and plugin settings. WP-CLI’s wp search-replace command is designed to handle serialized data intelligently, but you still need to review the tables and columns it will touch.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRun a dry run with WP-CLI
Replace the old and new URLs with your exact values and inspect the report before writing changes:
wp search-replace 'http://example.com' 'https://example.com' --dry-runFor a typical WordPress database using one prefix, you can limit the operation to prefixed tables. On a multisite or a database shared with other applications, identify the correct table scope first:
wp search-replace 'http://example.com' 'https://example.com' --all-tables-with-prefix --dry-runThe command searches and replaces strings in the database. A dry run reports potential changes without saving them. Review whether the old URL appears in the intended content, options, and metadata rather than unrelated application tables.
Apply the replacement and treat GUIDs carefully
After verifying the dry-run scope and retaining a backup, run the same command without --dry-run. WordPress migration guidance commonly advises leaving post GUID columns unchanged unless you have a specific, documented reason to change them; GUIDs are identifiers, not display URLs. If you intentionally exclude them, use the command’s column-exclusion option appropriate to your WP-CLI version and verify the resulting report. Never use an unreviewed blanket replacement across every database table.
Free tools Windows power users keep installed
One-click scans. No signup required.
Fix URLs outside the database
Search theme files, custom CSS, JavaScript, server configuration, and hard-coded template links for http:// references that the database command cannot change. Update third-party embeds only when their HTTPS endpoint is available. Purge site, proxy, and browser caches, then reload the page and confirm that the console no longer reports insecure requests.
7. Use the symptom to choose the shortest recovery path
“Too many redirects” on the whole site
- Open the HTTPS URL directly and verify the certificate and virtual host.
- Compare
WP_HOME/WP_SITEURLwith the database’shome/siteurl. - Check whether a proxy terminates TLS and whether it forwards the original HTTPS scheme.
- Temporarily disable redirect, cache, and security plugins.
- Retest in a private window after clearing cookies.
Do not begin with a search-and-replace if the browser cannot establish a valid HTTPS connection or the proxy is reporting the wrong scheme.
Login form reloads but the front end is normal
- Clear cookies for every hostname used by the site.
- Test
/wp-login.phpand/wp-admin/directly over HTTPS. - Check URL constants and database values for a hostname or scheme mismatch.
- Disable ordinary plugins and test again.
- Inspect must-use plugins and host-level login or cache layers if the problem remains.
Secure pages have broken images or scripts
- Use developer tools to identify the exact insecure requests.
- Run a backed-up, dry-run
wp search-replacefor the old URL. - Apply only the reviewed replacement, preserving serialized data and treating GUIDs separately.
- Correct hard-coded URLs in themes, custom CSS, JavaScript, and embeds.
- Purge caches and retest from a clean browser session.
8. Verify the repair and prevent a repeat
Once access returns, verify each layer instead of stopping at the first successful login:
- The certificate is valid for every canonical hostname and renews through the mechanism your host documents.
- HTTP redirects once to the chosen HTTPS URL; HTTPS does not redirect back to HTTP.
WP_HOME,WP_SITEURL,home, andsiteurlagree, or only the intentionally authoritative values remain.- A proxy or load balancer forwards the original scheme, and WordPress recognizes it only from that trusted proxy.
/wp-login.php,/wp-admin/, the front end, media uploads, and REST or AJAX requests work in a private window.- No mixed-content errors remain in the browser console.
- Plugins are re-enabled one at a time, with the conflicting component documented or replaced.
- A current database backup and a record of the final URL and proxy settings are stored with the site’s recovery documentation.
If you still cannot access the dashboard after these checks, stop changing values and review web-server access logs, PHP error logs, and proxy logs for the exact redirect sequence. The sequence will show which layer is issuing the redirect and whether the request arrives at WordPress as HTTPS.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
