A WordPress redirect loop happens when two or more rules keep sending the browser between URLs without reaching a final page. The loop can affect the whole site, only wp-admin, only the login screen, or a single URL. The fastest fix is to identify which layer owns the redirect instead of clearing random caches and changing plugins at the same time.
Quick diagnosis
- Login page keeps reloading: check cookies,
WP_HOME,WP_SITEURL, database home/siteurl values, login plugins, and cached login responses. - ERR_TOO_MANY_REDIRECTS on the whole site: check HTTP/HTTPS, www/non-www, CDN, host, and server redirect rules.
- Problem started after Cloudflare or SSL changes: compare the proxy SSL/TLS mode with the origin configuration and remove conflicting redirect rules.
Trace the redirect chain before changing settings
A redirect is normal when it happens once. A loop appears when one rule sends visitors to a second URL and another rule sends them back.
Common examples include:
http://example.com → https://example.com → http://example.comwww.example.com → example.com → www.example.comwp-admin → wp-login.php → wp-admin → wp-login.php
Use browser developer tools or a redirect-checking request to see the sequence. Do not change several systems until you know which URLs repeat.
Check WordPress Address and Site Address
Open Settings → General when possible. Confirm that the WordPress Address and Site Address use the intended hostname and protocol. If WP_HOME or WP_SITEURL is defined in wp-config.php, those constants can override database values and create a conflict.
After a migration, also check the database home and siteurl values. WordPress’s official login troubleshooting guidance specifically identifies incorrect URL values as a common cause of login redirect loops.
Login loops are often cookie or cache problems
WordPress uses cookies to maintain authentication. If the cookie is created for one hostname while WordPress redirects to another, the login session can fail even when the credentials are correct.
Test in a private browser window. If login works there, clear cookies for the site. Also make sure wp-login.php, wp-admin, and logged-in sessions are excluded from full-page caching.
Check HTTPS and proxy rules
Cloudflare, a reverse proxy, a hosting panel, Apache, Nginx, and WordPress can all add redirects. Multiple redirects are not automatically wrong, but two systems forcing opposite schemes or hostnames create a loop.
If the problem began after enabling HTTPS or a CDN, inspect that change first. Make sure WordPress recognizes the request as HTTPS and that the proxy-to-origin connection does not cause the origin to redirect back to a different scheme.
Temporarily test redirect, security, and login plugins
Plugins can redirect users based on login state, role, language, membership, SSL, or custom URL rules. If the loop began immediately after a plugin change, deactivate that specific plugin first. If wp-admin is inaccessible, temporarily rename the suspected plugin directory through the hosting file manager or SFTP.
Safe troubleshooting order
- Record the exact URL that loops.
- Test in a private browser window.
- Trace the redirect chain.
- Verify WordPress Address, Site Address,
WP_HOME, andWP_SITEURL. - Check the database home and siteurl values after a migration.
- Exclude login/admin pages from full-page cache.
- Review CDN, hosting, Apache, and Nginx redirect rules.
- Test recently changed redirect, SSL, security, or login plugins.
Official reference
Bottom line: WordPress redirect loops are usually caused by two systems disagreeing about the final URL or by authentication cookies that do not match the redirect destination. Trace the repeated URLs first, then fix the layer that owns the conflicting rule.