If WordPress keeps logging you out, the usual cause is not your password: the browser is receiving a login cookie that no longer matches the site URL, security settings, or server response. Start by clearing cookies for the site and testing an incognito window. Then make the WordPress Address and Site Address identical, verify HTTPS and proxy settings, and isolate plugins, rewrites, caches, and cookie constants in that order. Regenerate authentication salts only after the reversible checks fail, because doing so signs out every user.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What “WordPress keeps logging me out” usually means
WordPress does not keep your login in the page itself. After you authenticate, it sets cookies that identify your session and signs those cookies with authentication keys in wp-config.php. Your browser sends the cookies back on later requests to /wp-admin/, the editor, and other protected pages. A mismatch in the domain, path, protocol, signature, or cached response makes WordPress treat a valid cookie as invalid. The visible result is a return to the login screen, a “session expired” notice, or an admin area that logs you out after a few minutes.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →For someone publishing game reviews, guides, or screenshots, the symptom can appear in several forms:
- The login page accepts your password but immediately displays the login form again.
- You can open the dashboard, but saving a post sends you back to
wp-login.php. - One browser works while another repeatedly logs out.
- The front end works, but
/wp-admin/says your session has expired. - Only visitors using
www, HTTPS, a subdirectory, or a CDN edge are affected.
Use the fixes below from lowest risk to highest impact. Stop as soon as the problem is resolved; changing several layers at once makes the original fault harder to identify.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Quick diagnosis: match the symptom to the likely cause
| What you see | Most likely cause | First check |
|---|---|---|
| Private browsing works, normal browsing does not | Stale or corrupted cookies | Delete cookies for the site domain and retry |
| Login loops after a domain or HTTPS change | WordPress Address and Site Address differ | Compare both fields character by character |
| Only the CDN or proxy path fails | Incorrect protocol forwarding or SSL termination | Confirm the origin receives HTTPS and the certificate is active |
| All users were logged out at once | Authentication salts changed | Check recent wp-config.php edits |
| Problem began after a security, redirect, or cache change | Plugin, .htaccess, or server cache interference |
Disable or bypass one layer at a time |
| Only a subdirectory or multisite behaves incorrectly | Custom cookie paths or domain constants | Review COOKIE_DOMAIN, COOKIEPATH, SITECOOKIEPATH, and ADMIN_COOKIE_PATH |
Fix 1: clear the site cookies and test privately
Cookie cleanup is the safest first action and is fully reversible. A browser can retain a cookie created before a migration from HTTP to HTTPS, a change from non-www to www, or a move into a subdirectory. That old cookie may continue to be sent alongside the new one.
- Sign out if WordPress gives you a working sign-out link.
- Open your browser’s site-data or privacy settings and remove cookies and stored data for the exact WordPress domain. Delete entries for both the
wwwand non-wwwhost if you have used both. - Close existing WordPress tabs, reopen the browser, and visit the canonical login address.
- Test in a private or incognito window before restoring extensions. Do not use a bookmarked URL that points to an old protocol or hostname.
If the private window remains logged in, the server-side configuration is probably fine and the regular profile contains stale data or an extension that alters cookies. Clear the normal profile’s site data, then re-enable extensions one at a time. If both modes fail, continue with the URL checks.
Fix 2: make the two WordPress URLs identical
In the dashboard, go to Settings > General. The fields WordPress Address (URL) and Site Address (URL) must use the same protocol, hostname, path, and spelling for a standard single-site installation.
- Use
https://in both fields when HTTPS is active. - Use either
www.example.comin both orexample.comin both; do not mix them. - Include the same subdirectory in both fields if WordPress is installed below the document root.
- Do not add a trailing slash. For example, use
https://example.com, nothttps://example.com/.
Save the settings, clear the site cookies again, and log in through the resulting canonical URL. A mismatch can cause WordPress to set a cookie for one host while the browser requests another, producing a login loop or a session that disappears during an editor request.
When the General Settings page will not save
A redirect loop, immediate logout, or damaged admin screen can prevent you from changing the fields. In that case, define the URLs in wp-config.php above the line that says WordPress has stopped editing.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
define('WP_HOME', 'https://example.com');
define('WP_SITEURL', 'https://example.com');Replace example.com with your real canonical domain. Both values should include https:// when that is the public protocol and should have no trailing slash. These constants override the corresponding database values and lock the fields in the General Settings screen until the definitions are removed. Keep a backup of the file and use your hosting file manager or SFTP with the correct permissions.
Recommended Free Tools
Fix 3: verify HTTPS, certificates, and reverse-proxy headers
On a site behind a CDN, load balancer, or reverse proxy, the browser may connect over HTTPS while the origin server believes the request is HTTP. WordPress can then generate a cookie or redirect for the wrong protocol. The same symptom appears when an SSL certificate is expired, attached to the wrong hostname, or active only on some server nodes.
Checks to make
- Open the public home page and login page directly with
https://; confirm the certificate covers the exact hostname, including whether it useswww. - Check the proxy or CDN setting that forwards the original protocol to the origin. It must accurately indicate HTTPS for secure requests.
- Ensure HTTP-to-HTTPS redirects do not alternate between two hosts, such as redirecting
https://wwwtohttp://and back again. - Temporarily bypass the proxy, if your host permits it, to determine whether the origin works without the edge layer.
For an admin-area HTTPS requirement, some WordPress installations use FORCE_SSL_ADMIN in wp-config.php. Add or change that setting only after confirming the certificate and proxy protocol are correct; forcing SSL while the server cannot recognize HTTPS can create a redirect loop rather than fix the cookie.
Fix 4: inspect custom cookie constants
Most single-site installations calculate cookie scope from the site URL automatically. Problems arise when an old migration, a multisite configuration, or a copied configuration file leaves custom constants that no longer describe the current host and path.
In wp-config.php, look for:
COOKIE_DOMAINCOOKIEPATHSITECOOKIEPATHADMIN_COOKIE_PATH
Record the existing values before editing. For a normal single-site install, removing unnecessary custom definitions lets WordPress derive the scope from the canonical URL. If a custom domain is genuinely required, set COOKIE_DOMAIN to the real domain—not a guessed subdomain—and ensure the path constants match the installation’s directory. Multisite and subdirectory setups can require deliberate values, so do not delete working definitions without a backup and a rollback plan.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Fix 5: isolate security plugins
Security plugins can invalidate cookies, enforce a different login URL, add aggressive session checks, or block requests that resemble repeated logins. Examples named in troubleshooting documentation include Wordfence, iThemes Security, and Sucuri. The goal is not to remove security permanently; it is to determine whether one plugin is changing the authentication flow.
- Back up the site and note which security plugins are active.
- Use FTP or your host’s file manager to rename the suspected plugin’s folder inside
wp-content/plugins. Add a temporary suffix such as-disabled; do not delete files. - Open a fresh private window and test login, dashboard navigation, and saving a draft.
- If the issue disappears, restore the original folder name, reactivate the plugin, and review its cookie, brute-force, login URL, session, and cache settings. Update it before re-testing.
- If several security plugins are active, test them separately so you can identify the conflicting rule.
If renaming the folder prevents the plugin from loading but you still cannot log in, restore the name and move to the next diagnostic layer rather than leaving protection disabled.
Fix 6: test .htaccess and rewrite rules
On Apache hosting, malformed rewrite rules can redirect the login request, strip a path, or send an authenticated request through a cached route. A rule copied from another site is especially risky after changing domains or moving WordPress into a subdirectory.
- Back up the existing
.htaccessfile by downloading it. - Rename the live file temporarily, for example to
.htaccess.disabled. - Test login and an admin action in a private window.
- If the problem is gone, sign in and go to Settings > Permalinks. Click Save Changes without changing the structure; WordPress will write a fresh baseline rewrite file.
- Reapply only documented custom redirects, testing after each addition.
Do not leave the site without the rewrite rules it needs for pretty permalinks, and do not paste directives intended for a different server (such as Nginx) into an Apache file.
Free tools Windows power users keep installed
One-click scans. No signup required.
Fix 7: bypass page and object caching for authentication
A cache must never serve a stored login page, dashboard response, nonce, or authenticated redirect to another request. Configure the page cache, reverse proxy, CDN, and host cache to bypass at least wp-login.php, /wp-admin/, and requests carrying WordPress login cookies. Purge existing cache entries after changing the rules.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
To test safely, temporarily disable the cache layer or switch it to a development mode, then clear the browser’s site data. If the session stays valid with caching disabled, keep the bypass rules and check whether an optimization plugin is minifying or combining login scripts. Object-cache services can also preserve stale options after a URL change; flush them through the host’s control panel or the service’s documented method.
Fix 8: update WordPress, plugins, and the active theme
Outdated core files, plugins, or themes can use obsolete login hooks, emit headers too late, or conflict with current PHP and SSL behavior. First create a backup that includes the database and wp-config.php. Apply updates in a staging site when possible, then test the login, dashboard navigation, media upload, and post-saving workflow. If the issue started immediately after one update, roll back that component using your host’s backup or a maintained rollback process, and contact its developer with the browser console and server-log details.
Fix 9: regenerate authentication salts only as a last resort
Authentication salts and keys in wp-config.php sign the cookies. If they were accidentally changed, partially copied, or differ between web servers, every existing cookie can fail validation. Regenerating the complete key block creates a clean signature set, but it deliberately logs out every user once, including editors and administrators.
- Make a full backup of
wp-config.phpand store the old copy securely. - Open the official WordPress salt generator at api.wordpress.org/secret-key/1.1/salt/.
- Copy the generated definitions for
AUTH_KEY,SECURE_AUTH_KEY,LOGGED_IN_KEY,NONCE_KEY, and their corresponding salts. - Replace the existing key-and-salt block without altering database credentials or other constants.
- Save the file, clear your browser’s site cookies, and log in again. Notify other users that their sessions will need to be re-established.
If the outage began after a configuration deployment, restoring the previous wp-config.php restores the previous keys and therefore the old cookie signatures. Do not regenerate salts repeatedly while debugging a different URL or cache problem; each change creates another site-wide logout.
Changing the stored URL when normal methods fail
Using RELOCATE briefly
WordPress developer documentation describes the RELOCATE constant as an emergency way to change the stored siteurl. Define it temporarily in wp-config.php, visit the login URL at the intended domain, and then remove the definition immediately. Leaving RELOCATE enabled is insecure because, in some configurations, an attacker could influence the stored site URL.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Editing the database
In a database tool, locate the options table (its prefix may not be wp_) and update the rows whose option_name values are siteurl and home. Set both option_value entries to the same canonical URL, with HTTPS where used and no trailing slash. Back up the database first. Multisite installations require extra care and may require direct database edits for the relevant network or site records.
Using WP-CLI
From the WordPress directory, an administrator with shell access can update the stored home URL with a command such as:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
wp option update home 'https://example.com'
wp option update siteurl 'https://example.com'Use your actual domain and the correct site context. In multisite, ordinary single-site option commands may not update every site, so verify the target before running them.
Why the problem can appear only for some users
Different hostnames or bookmarks
One editor may use a saved www address while another uses the non-www address. The sessions are scoped differently even though both pages look identical. Publish one canonical admin URL and redirect alternate hostnames to it.
Extensions and privacy settings
Cookie-blocking extensions, strict tracking protection, and corporate browser policies can reject or partition authentication cookies. Compare a clean private window, a second browser, and the affected browser with extensions disabled. This comparison distinguishes a local browser policy from a server fault.
Multiple web servers
If a load balancer sends requests to servers with different salts, URL constants, or deployment versions, a login can succeed on one request and fail on the next. Confirm that every node uses the same wp-config.php values, code version, filesystem, and clock configuration, and that sessions are not being routed to an incompatible cache.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Recovery checklist for a stable gaming site
- Choose one canonical HTTPS hostname and use it in both WordPress URL fields.
- Document whether WordPress is installed at the domain root or a subdirectory.
- Keep a dated backup of
wp-config.phpbefore changing URLs, salts, or cookie constants. - Exclude login, admin, nonce, and authenticated-cookie requests from every cache layer.
- Keep security, redirect, cache, core, plugin, and theme changes separately testable.
- After a migration, clear old browser cookies and test an incognito login before inviting editors back.
- Monitor failed-login and redirect logs for repeated host or protocol changes.
When to ask your host for help
Contact hosting support after you have recorded the exact login URL, browser, time of failure, public hostname, and whether incognito mode works. Ask them to check proxy protocol headers, certificate coverage, cache bypasses, rewrite processing, and whether all web nodes share the same configuration. Provide timestamps rather than passwords or cookie values. A host can inspect server logs and edge rules that are not visible from the WordPress dashboard.
For most sites, the successful path is short: clear the site cookie, standardize both WordPress URLs, and correct HTTPS handling. Plugin, rewrite, and cache isolation then identifies the less common cases. Salt regeneration is effective for a genuine signature mismatch, but its deliberate all-user logout is why it belongs at the end.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
