The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →If WordPress sends you back to the login form, says cookies are blocked, or rejects a password immediately after setup, start at https://example.com/wp-login.php using the same domain and HTTPS scheme as the site. Confirm the case-sensitive WordPress credentials, clear that site’s cookies, and retry in a private window. These steps resolve most browser and credential mistakes without changing production files.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
If the form still reloads, work through the configuration and isolation checks below in order: make WP_HOME, WP_SITEURL, and the database URLs agree; disable plugins and the active theme by renaming their folders; then use email or WP-CLI to recover the password. Redirects that persist after those checks usually require the host to correct SSL termination, proxy, cache, DNS, or server settings.
As an Amazon Associate I earn from qualifying purchases.
Use the correct login address and account
The normal WordPress login endpoint is https://example.com/wp-login.php. Visiting /wp-admin/ while logged out redirects to the login page automatically, so that redirect by itself is expected. Replace example.com with the site’s real canonical domain and use https when the site is served over HTTPS.
WordPress usernames, account email addresses, and passwords are case-sensitive. A hosting-panel, FTP, database, or email password is not automatically the WordPress password. Enter the WordPress username or the email address attached to that user account, without extra spaces copied from a password manager.
#1 Best Overall
Check the address before changing anything
- Use the public domain visitors use, not an IP address, temporary host name, or a different subdomain.
- Keep the scheme consistent: do not open an HTTP login page and expect an HTTPS authentication cookie, or vice versa.
- If the site recently moved domains, confirm that the old address is not redirecting to the new one in a loop.
Quick browser and cookie fixes
Authentication depends on cookies. WordPress first sets wordpress_test_cookie to check that cookies work, then sets authentication cookies such as wordpress_[hash] and wordpress_logged_in_[hash]. If the browser refuses the test or authentication cookie, WordPress can report that cookies are blocked or repeatedly display the login form.
- Delete cookies and cached data for the site only. Close all tabs for that domain, reopen the browser, and go directly to
/wp-login.php. - Ensure cookies are enabled for the site. Temporarily turn off strict privacy settings, content blockers, or extensions that modify cookies, redirects, or login forms.
- Retry in a private/incognito window. If that works, an extension or stale cookie in the normal profile is the likely cause.
- Try a second browser and, if possible, a different device or network. A result that changes by browser points to the local client rather than WordPress.
- Type the credentials manually once. Disable automatic password filling temporarily so an old password or wrong username is not being submitted.
When the form simply reloads
A form that returns to a blank login page after a seemingly valid submission commonly indicates a cookie failure, a cached copy of wp-login.php, or a plugin that alters authentication. Exclude the browser causes above first. A page-cache or CDN rule must never cache a personalized login response; ask the host to bypass caching for wp-login.php, /wp-admin/, and logged-in requests if the problem affects every browser.
Recognize the symptom before choosing a recovery path
| What you see | Most likely area | First action |
|---|---|---|
| “Cookies are blocked” or the login page keeps reappearing | Browser cookie policy, cached login page, security plugin, or URL mismatch | Clear site cookies, test privately, then check URL settings |
| “Too many redirects” | Conflicting HTTP/HTTPS or domain redirects; proxy, CDN, or host rules | Make every WordPress URL and upstream scheme agree |
| “Unknown username” or “incorrect password” | Wrong WordPress account, capitalization, or password | Use the account email and the password-reset link |
| Password reset email never arrives | Wrong account email, spam filtering, or server mail delivery | Verify the address, check spam, then use WP-CLI if server access exists |
| Problem began after installing a plugin or theme | Plugin or theme conflict | Rename the plugins directory, then isolate the active theme |
Fix redirect loops and URL mismatches
WordPress builds login and admin links from two site URLs. A mismatch between the values in wp-config.php, the database, and the web server can send the browser from HTTP to HTTPS and back, or between two hostnames. The same inconsistency can make a valid cookie appear to belong to the wrong domain or scheme.
Inspect WP_HOME and WP_SITEURL
Using SFTP, FTP, or the host file manager, make a backup of wp-config.php before editing. Look for definitions such as:
define('WP_HOME', 'https://example.com');
define('WP_SITEURL', 'https://example.com');Both values should use the site’s real canonical hostname and the same HTTP or HTTPS scheme. Do not leave one value on HTTP, point one at a staging hostname, or add a different path unless WordPress is intentionally installed in a subdirectory. Keep the values exactly consistent with the address you use to open wp-login.php.
Constants in wp-config.php override the corresponding database values. If they are present and wrong, correcting only the database will not fix the redirect.
Free tools Windows power users keep installed
One-click scans. No signup required.
Check the database options
If you have a database backup and access to phpMyAdmin or another database tool, inspect the home and siteurl rows in the WordPress options table. The table may not be named wp_options if a different table prefix was chosen during setup. A read-only query is:
SELECT option_name, option_value
FROM wp_options
WHERE option_name IN ('siteurl', 'home');Set both values to the same canonical URL used in wp-config.php and by the browser. Preserve the correct installation path if WordPress lives below the document root. Do not change unrelated options, and take a backup before saving changes.
Account for reverse proxies and SSL termination
On some hosts, a proxy or CDN accepts HTTPS from the visitor and forwards HTTP to the origin. If the origin does not receive the forwarded HTTPS state correctly, WordPress may continually issue an HTTPS redirect. A host must verify the proxy’s forwarded-protocol setting, the origin’s SSL configuration, and any server-level redirect rules. Also check that DNS points to the intended server and that there is no second service redirecting the hostname.
Do not keep switching URLs at random: every change can create another redirect layer. Once the canonical domain and scheme are chosen, apply that choice consistently in WordPress, the web server, the proxy, and the browser.
Rank #3
Disable plugins without dashboard access
A plugin can replace the login URL, enforce a redirect, block cookies, or reject an otherwise valid request. You can test for this without logging in by renaming the plugins directory through SFTP, FTP, or the host’s file manager.
- Open the WordPress installation directory and locate
wp-content/plugins/. - Rename
pluginsto a temporary name such asplugins.disabled. Renaming preserves the files; do not delete the directory. - Open
/wp-login.phpin a private window and test the login. - If access returns, rename the directory back to
plugins. In the dashboard, reactivate plugins one at a time, testing the login after each activation. The plugin activated immediately before the failure is the likely conflict.
If renaming the directory changes nothing, restore its original name before continuing. A missing or incorrectly named directory can create a second problem unrelated to the original login failure.
Test the active theme
The active theme can run code during login or redirect requests before the dashboard loads. If plugins are not responsible, use the same file access method to identify the active theme folder inside wp-content/themes/ and rename that folder temporarily. Keep the files intact. WordPress can use another installed theme as a fallback; if no usable fallback exists, install or restore one through the host before testing.
Try the login again. If it works, restore the original folder name and switch to a known-good theme from the dashboard, then inspect or update the original theme. Do not rename every theme at once: retaining the other folders makes it possible for WordPress to select a fallback and lets you identify the actual conflict.
Recover the password
Use the email reset first
Select Lost your password? on the login page and submit the account username or email address. Check the mailbox’s spam, junk, quarantine, and filtering rules. Confirm that you used the email address stored on the WordPress user account; a hosting account’s contact address may be different.
Rank #4
If no message arrives, repeated requests will not repair a server-side mail problem. The site may have incorrect mail settings, a blocked outbound connection, or an address that is no longer accessible. Ask the host to check mail delivery after confirming that the account details are correct.
Reset an administrator password with WP-CLI
When dashboard access and email are unavailable but you have shell access to the WordPress installation, WP-CLI can update the user securely. Run commands from the WordPress directory and use the actual login name or numeric user ID.
wp user list
wp user update ADMIN_LOGIN --prompt=user_pass
wp user reset-password ADMIN_LOGIN --show-passwordwp user update with --prompt=user_pass asks for the new password without putting it in shell history. wp user reset-password can generate a password; when --show-password displays it, treat that output as sensitive, transfer it through a secure channel, and change it again after signing in. Never paste an administrator password into a public ticket, chat, command shared with other users, or an unprotected script.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsAfter a successful reset, return to wp-login.php, sign in, and update the account’s email address if necessary so future resets work. Restore any temporarily renamed plugin or theme directories and reactivate components individually rather than re-enabling everything at once.
Database recovery requires extra caution
A direct database password change is possible, but it is easy to corrupt the stored value or edit the wrong user when table prefixes differ. Use a current backup, identify the correct user row, and follow the database tool’s documented WordPress-compatible method. Prefer the email reset or WP-CLI when either is available; ask the host for help before making an irreversible database edit.
Best Value
Choose the least risky recovery route
| Route | What you need | Production risk | Best use |
|---|---|---|---|
| Browser cleanup and private-window test | Only access to the site | Very low; changes local cookies | One browser fails, cookies are blocked, or the form loops |
| Email password reset | Access to the WordPress user’s email | Low | Password is forgotten and mail delivery works |
| Rename plugins or theme folders | SFTP, FTP, or host file manager | Low to moderate; temporarily disables code | Failure began after an extension or theme change |
| WP-CLI password update | Shell access and the WordPress directory | Moderate; changes an administrator credential | Email is unavailable but server access exists |
| Edit URL options or proxy settings | Configuration or host access | Moderate to high; can affect every visitor | Redirect loops persist across browsers and devices |
| Host escalation | Support account and diagnostic details | Lowest for the site owner when server-side faults are suspected | DNS, SSL termination, cache, proxy, or server rules are involved |
When the host must fix the server
Escalate when the same login failure occurs in multiple browsers and networks, or when the site alternates between HTTP and HTTPS, changes hostnames, or reports a redirect loop before WordPress can establish a session. The host controls DNS, certificates, reverse-proxy headers, server redirects, object or page caches, and sometimes outbound email. Those layers can prevent WordPress from setting or receiving its authentication cookies even when the WordPress files are correct.
Tell support exactly what you observed: the full login address, whether the error is a reload, cookie warning, or redirect loop, whether the problem affects every browser, and the time it occurred. Ask them to verify the canonical hostname, certificate and HTTPS forwarding, redirect rules, cache exclusions for login and authenticated requests, and mail delivery if a reset message is missing.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Prepare a useful support report
If the checks above do not restore access, collect the details WordPress support requests. Do not post passwords, reset links, database credentials, private keys, or complete configuration files.
- WordPress version and whether the installation is single-site or multisite.
- PHP version and database type and version (MySQL or a compatible service).
- Browser name and version, operating-system version, and whether private browsing or another device changes the result.
- Web-server type, hosting arrangement, CDN or reverse proxy, and recent domain, SSL, migration, plugin, or theme changes.
- The exact error text and the login URL, with any sensitive query strings removed.
- Which steps you completed: cookie clearing, URL checks, plugin/theme isolation, email reset, and WP-CLI attempts.
Providing this information prevents support from repeating basic tests and helps distinguish a browser problem from WordPress configuration or hosting infrastructure.
Quick Recap
Final verification after access returns
- Open a new private window and sign in through the canonical HTTPS
/wp-login.phpaddress. - Visit
/wp-admin/while logged in to confirm the session persists. - Restore the original names of any temporarily renamed directories.
- Reactivate plugins one by one and test a fresh private-window login after each activation.
- Confirm
WP_HOME,WP_SITEURL,home, andsiteurlstill agree, then clear any stale site cookies. - Store the administrator’s current email address securely and keep a recent backup before changing authentication or URL settings again.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
