The wp-admin login keeps looping

When the login page just reloads, or the browser stops with ERR_TOO_MANY_REDIRECTS, the browser is caught in a redirect loop between two addresses. It happens when the address WordPress has stored doesn't match the address the site is actually accessed on: HTTP versus HTTPS, or with and without www.

It also happens when a proxy in front of the server, such as Cloudflare, handles HTTPS while WordPress or the server also redirects to HTTPS.

See which addresses the loop goes between

Paste the address into httpstatus.io. It lists every redirect with its status code and target. You can then see whether the loop goes between HTTP and HTTPS, between the www and non-www addresses, or back to the same address over and over. The last pattern points to Cloudflare in Flexible mode, see When the site is behind Cloudflare or a proxy.

Try a private window

1. Open the login page in a private or incognito browser window and log in there.
2. If that works, delete the cookies for the site in your normal browser and try again.
3. Check that you use the same address the site runs on, with or without www.

If you get "Error: Cookies are blocked or not supported by your browser.", allow cookies for the site. If the message still appears, the address may be wrong, so move on to the next section.

Fix the address in wp-config.php

The address WordPress uses is stored in the database, but wp-config.php can override it.

1. Connect with FTP or the file manager in your hosting panel, and download a copy of wp-config.php.
2. Check whether the file has lines with WP_HOME or WP_SITEURL. If it does, correct the address in them.
3. If not, add them above the line /* That's all, stop editing! Happy publishing. */:

define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );

Write the address exactly as visitors should reach the site: with https://, with or without www, and no trailing slash. Upload the file and try to log in again.

Turn off plugins and redirects

Plugins for SSL, redirects, security and caching can also cause a redirect loop, for example Really Simple SSL.

1. Open wp-content and rename the plugins folder, for example to plugins-off.
2. Try to log in. If it works now, go to Plugins while the folder still has the new name. WordPress then deactivates all plugins.
3. Rename the folder back to plugins, and activate the plugins one by one until the error returns.
4. If that didn't help, look for rules that redirect to HTTPS or www. On Apache and LiteSpeed they're in .htaccess in the root folder, above the line # BEGIN WordPress. On Nginx they're in the server configuration, as return 301 or rewrite lines. Make a copy of the file before you remove anything.

When the site is behind Cloudflare or a proxy

If you use Cloudflare, check the encryption mode under SSL/TLS. In Flexible mode, Cloudflare connects to your server over plain HTTP. If the server or WordPress then redirects every visitor to HTTPS, the browser is sent to the same HTTPS address over and over, because the server never sees that the request came in over HTTPS. Set the mode to Full or Full (strict). That requires the server to have its own SSL certificate.

If the site sits behind another proxy or load balancer that handles HTTPS, WordPress needs to know that the request came in over HTTPS. Add this to wp-config.php, above the "stop editing" line:

if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && strpos( $_SERVER['HTTP_X_FORWARDED_PROTO'], 'https' ) !== false ) {
	$_SERVER['HTTPS'] = 'on';
}

When you're stuck

If it still loops with the right address, all plugins off and Cloudflare on Full, the redirect is in the server configuration, which you can't see from WordPress. In that case your hosting provider has to check the server setup and the certificate for the domain.