Can't Log Into WordPress Admin? Fixing Login Loops, Redirects and Lockouts

What is the problem?

“Login not working” on WordPress splits into two genuinely different problems that get lumped together because they feel the same in the moment. The first is a login loop: you submit the form, the page reloads, and you're back at the login screen with no error at all — as if you'd never submitted anything. The second is an explicit lockout: WordPress or a security plugin tells you directly that you've been blocked, usually with a message about too many failed attempts and a wait time attached.

Quick answer: a silent loop is almost always a URL, cookie or session mismatch — WordPress and your browser disagreeing about which domain the login cookie belongs to. An explicit lockout is a deliberate block from a security plugin, and needs clearing rather than diagnosing. They're fixed differently, so knowing which one you have saves real time.

Both are separate from a site being down. The homepage, your posts, your checkout — all of that can be working perfectly for every visitor while the one specific process of authenticating as an admin fails. That's what makes this frustrating to search for: most general WordPress troubleshooting advice assumes the whole site is broken, when here it's one gate that's stuck.

Common symptoms

• You enter the correct username and password, click Log In, and land back on the exact same login screen with no error message shown
• A browser warning appears saying “Cookies are blocked or not supported by your browser”
• After submitting, you're redirected to an unexpected domain, a strange URL, or an old address the site used to live at
• A password reset email never arrives, even after requesting it two or three times and checking spam
• Clicking a password reset link that did arrive shows “Error: The link you followed has expired”
• You're told outright that you've been locked out after too many failed attempts, with a specific wait time before trying again
• A blank or white page appears the instant you submit the login form, distinct from the site being generally blank — everything else on the site loads fine

Why does this happen?

Logging into WordPress isn't just a password check. Once your credentials are accepted, WordPress sets an authentication cookie in your browser tied to a specific domain, and every subsequent admin page checks that cookie against two stored values — the WordPress Address and the Site Address — to decide whether you're really logged in. If those two values don't exactly match the domain you're actually visiting, the cookie gets written but never successfully read back, and you're bounced to the login screen again. It looks like the password failed. It didn't — the session simply never stuck.

A lockout works on entirely different logic. Security plugins count failed login attempts against a threshold and block further tries once it's crossed, the same way a bank card locks after repeated wrong PINs. That threshold doesn't know or care whether the failed attempts came from an attacker running a script or from you, five minutes ago, mistyping a newly changed password twice in a row.

Common technical causes

• WP_HOME and WP_SITEURL mismatched with the domain actually being used to access the site — common after a migration, a domain change, or moving from http to https without updating both
• A cookie-domain mismatch between www and non-www versions of the domain, so the login cookie is set on one variant and checked against the other
• Corrupted or expired authentication cookies left over from before a security change, a password reset, or a plugin update that altered how sessions are handled
• A security or “limit login attempts” plugin triggering a lockout — frequently from the site owner's own mistyped attempts, not an actual attack
• Outgoing mail not properly configured, so WordPress's password reset emails silently fail to send even though the site reports “check your email” regardless
• A caching plugin caching the login page itself, serving a stale form or an invalid session token to every visitor who loads it
• Leftover lockout state in the database from a security plugin, sometimes persisting even after that plugin has since been deactivated
• A corrupted user role or capability entry preventing one specific account from completing login even with the correct password, while other accounts work fine

How to diagnose it

1. Compare the WordPress Address and Site Address to the URL in your browser bar. If you can reach another working admin account, check Settings → General. If not, this is visible directly in wp-config.php, or in the wp_options table (the siteurl and home rows) via phpMyAdmin.
2. Try a private/incognito window with cookies fully cleared. This rules out a stale local cookie in under a minute and is the fastest test on this list — if login works here, the problem is a cookie stuck in your regular browser, not the site.
3. Test whether outgoing mail works at all, using a dedicated SMTP-test or mail-logging plugin, rather than assuming a reset email is “just in spam.” Many hosts silently drop WordPress's default mail function.
4. Check for a security plugin's lockout log. Most log the blocked IP and the reason, which tells you immediately whether this is a genuine block versus a URL or cookie issue.
5. Purge every cache layer and retest if you suspect the login page itself is being served from cache — a caching plugin, a CDN, and the browser cache can each independently cause this.
6. If you have database access, check the wp_options table for a lockout-related row left by a security plugin, even one that's since been deactivated — deactivating a plugin doesn't always clear its stored state.

How to fix it, step by step

1. Correct WP_HOME and WP_SITEURL directly in wp-config.php if they don't match your real domain. This is the single most useful step here, because it works even while you're completely locked out — it doesn't require logging in at all, only FTP or File Manager access.
2. Clear cookies for the domain entirely and retry in a fresh private window, to eliminate a stale local session as the cause before changing anything server-side.
3. If a security plugin is the cause, clear the lock directly. Delete its relevant row from the wp_options table via phpMyAdmin, or rename its plugin folder over FTP to force-deactivate it and release the block immediately.
4. Exclude wp-login.php from every caching layer so it's never served stale to any visitor, including you.
5. Set up real outgoing mail via an SMTP plugin connected to an actual mail provider, so password reset emails reliably arrive going forward — this is one of the most common root causes here and among the easiest to permanently close.
6. As a last resort with database access, reset the password directly via phpMyAdmin by updating the account's password field with a properly hashed value (a dedicated password-hash generator, not typing plain text), rather than waiting on an email that isn't going to arrive until mail is fixed anyway.
7. Remove or correct any .htaccess rule restricting access to wp-login.php by IP, if one was added previously for security and is now blocking the legitimate owner, for instance after a change of location or ISP.
8. If the problem is isolated to one specific account, check that user's role and capabilities via a second working admin account, or directly in the database if no second account exists.
9. Once back in, adjust the security plugin's lockout thresholds — attempts allowed, lockout duration, and whitelisting your own IP — so a handful of genuine typos doesn't lock you out again next week.

When this needs professional help

A cleared cookie or a corrected setting resolves plenty of these cases without needing a developer. It's worth bringing one in when:

• Fixing WP_HOME/WP_SITEURL or resetting a password means editing the database directly, and phpMyAdmin isn't something you're comfortable working in
• The lockout plugin's stored state is unclear, and deleting the wrong database row risks other settings you'd rather not lose
• There's no FTP or hosting-panel access set up at all, so even the wp-config.php fix isn't reachable without first sorting out access with your host
• The login issue appeared alongside signs of a compromised site — an admin account you don't recognise, unfamiliar plugins — which changes the priority to a security review before anything else
• You've cleared the obvious causes and are still bounced back to login with no explanation, which usually means two smaller issues are stacked together

How I can help

Getting locked out of your own site carries a particular kind of urgency, because nothing else feels safe to fix until access is back. Over eleven years of freelance WordPress work I've dealt with login loops caused by every one of the causes above, and I treat it as two jobs done in order: get you back in first, safely, usually through a careful wp-config.php or database fix rather than anything drastic, then find and close the actual root cause — a mail setup that was never configured properly, a stuck lockout, a leftover URL from an old migration — so it doesn't happen again next month.