When trying to login one of my WP installs (regular WP 3.4.2-no multisite), I keep being redirected to the wp-login.php file.

I've checked nearly everything:

  • Password is correct and changed...nothing

  • Reset to a default theme...nothing

  • Deactivated al plugins...nothing

  • Reuploaded my wp-login.php file...nothing

  • Checked the .htaccess files...nothing

  • wp-config.php still looks the same.

  • Erased my browser data and used an other browser... Still nothing.

  • Completely overwritten every WordPress file with a fresh download install.

What else could this be? I didn't make any upgrades to the code.

  • 1
    Can you try a different browser? Highly unlikely it will help but you want to rule everything out in case a potential browser addon is causing an issue with cookies or referrers. Also is this problem new? Were you able to login at an earlier date? Or is this a newly installed blog/site?
    – Adam
    Oct 23, 2012 at 11:56
  • @userabuser, tried that too. I'm working in Chrome, tried erasing all browser data, tried using Firefox, tried using the private browser mode... Nothing works.
    – Pieter
    Oct 23, 2012 at 11:59
  • For Panda sadness I recommend eating bamboo. That aside, can you answer the updated comment above (I added some additional questions).
    – Adam
    Oct 23, 2012 at 12:01
  • 1
    Everything worked on before, we had an amazing weekend with 10K visitors each day. Since this morning, I can't login anymore, it's always looped back to wp-login.php?redirect_to=http%3A%2F%2FXXXXX%2Fwp-admin%2F&reauth=1 (site url editted to XXX)
    – Pieter
    Oct 23, 2012 at 12:05
  • 1
    try adding define('ADMIN_COOKIE_PATH', '/'); see if this helps. What WP version are you on? Oct 23, 2012 at 12:06

4 Answers 4


Let's try this,

Open up your wp-login.php file and add the following update_option calls,

update_option('siteurl', 'http://your.domain.name/the/path' );
update_option('home', 'http://your.domain.name/the/path' );


require( dirname(__FILE__) . '/wp-load.php' );

so... it should look like,

require( dirname(__FILE__) . '/wp-load.php' );

update_option('siteurl', 'http://www.example.com/' );
update_option('home', 'http://www.example.com/' );

Where http://www.example.com/ should match your domain.

  1. Then visit your login page.
  2. Then remove the lines added to wp-login.php

You might need to refresh your login page a couple of times or try and login a couple of times but it should let you in. Might be neccessary to clear your cache.

If all of a sudden,


was appearing like,

http://example.com/ (no www - for example sake)

...then it might be causing this redirect loop issue you are having. Its easy to miss a slight change like that in your login URL as we often are not paying that close of attention.

So by running the update_option above we reset those paths to their original format.

IF its not the above then make sure you definitely PURGE all of your browser cookies because there is a mismatch somewhere that's causing the issue. Has to be.

  • Userabuser, thank you for your extended answer, but unfortunately it isn't solving the problem. Nothing changes in the URL. I've purged all my browser cookies several times, used the private browsing modus, used other browsers... I hope that I'm not far from the answer now. I'm replacing every WordPress file now. With a bit luck that might do the trick... Hopefully.
    – Pieter
    Oct 23, 2012 at 13:25
  • To clarify, you did try this method right? I.e. resetting the site and home URLs? Regardless of whether they appear to have changed or not.
    – Adam
    Oct 23, 2012 at 13:27
  • I've added the two update option lines after the wp-load require. Visited the wp-login.php and tried to login. Removed the two lines, made a few hard refreshes and tried to log in again... Without any luck. By the way, none of my users can login at this moment... So it shouldn't be a single browser related problem, no?
    – Pieter
    Oct 23, 2012 at 13:33
  • 1
    Can you try adding wp_clear_auth_cookie(); into the wp-login.php file (the function should be accessible there). Try and clear all authentication cookies. Then remove that line, revist wp-login.php and try logging in again.
    – Adam
    Oct 23, 2012 at 13:40
  • Added right after the wp-load require, removed it after a single load and tried. No progress.
    – Pieter
    Oct 23, 2012 at 14:02

I've solved the problem by putting back a backup of the evening before the problem.The cause of this problem will never be known. Server logs (access and error logs) don't give a clue. WP_debug doesn't give a clue. Every FTP file has been checked and overwritten.

The problem must be in the database somehow, but the wp_options table shows no errors. Thanks for thinking with me. It's been a valuable lesson. I hope this topic can be a help for anyone facing the same problem. Normally the list in my question should solve their problem.


Possible solution:

  • if your website is on 'https'
  • if you use custom login form to login

be sure to set $secure_cookie to true in wp_signon( $credentials, $secure_cookie )

I had same problem, user is logged in on front end, but if you try to reach wp-admin, you get redirected to login page and need to login again.

  • Hi Bobz - your solution is only working in my case - I test all other solutions, but only adding wp_signon( $credentials, $secure_cookie ) instead of wp_signon( '', $secure_cookie ) helps.
    – Dudeist
    Oct 16, 2017 at 1:35

I have had this happen to me and I have looked all over the web for answers and surprisingly no one has mentioned the idea that your site could have been compromised as mine had been.

First, via ftp, check the dates your files have been last updated. This should help you identify what those files may be.

If you have been compromised, the two quickest places to check... your index.php and your wp-login.php file

Look for this code: eval(base64_decode())

If you see this - you have been hacked and need to remove all instances of this throughout your site. I came across a pretty good tutorial on how to clean an entire site here

Once your site has been cleaned, you should be all good to login again, but I would recommend changing all names and passwords as your hack could be more malicious.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.