Locked Out of wp-admin: Login Loop Causes and Every Escape Route

You enter the correct password and land back on the login form. No error, no “incorrect password” — just a loop. That distinction matters: authentication worked; the session is not sticking. The loop has four usual causes, each with a tell.

Cause 1: Cookies blocked or domain mismatch

WordPress logs you in by setting an auth cookie for SITEURL. If the cookie domain and the URL you browse differ (www vs non-www, http vs https), the cookie is set for a site you are not on — instant loop.

• Test: check Settings → General (via WP-CLI if needed): wp option get siteurl --allow-root — it must match the URL in your browser’s address bar exactly, scheme included.
• Fix: correct the mismatch. If you cannot reach the admin: wp option update siteurl https://yourdomain.com --allow-root and same for home.

Cause 2: HTTPS/SSL half-configured

Site forced to HTTPS but the certificate invalid, or mixed cookie flags: browsers silently refuse the auth cookie. Test in a private window and check for certificate warnings; fix the certificate (Let’s Encrypt via hosting panel) rather than fighting the loop.

Cause 3: A security plugin is locking you out

Failed-login lockouts, IP bans, and 2FA misconfigurations all produce loops — sometimes with an email notice you never received (see why WordPress mail fails).

• Fix without admin: rename the security plugin’s folder in wp-content/plugins via file manager — it deactivates with its rules. Log in, then re-enable and whitelist your IP.

Cause 4: Corrupted or overflowing session state

Rare, but after migrations or cache misconfigurations, stale cookies cause loops. Test: clear cookies for the domain (or a fresh incognito window) — if login works there, it was cookie state, and the fix is nothing more dramatic than that.

The emergency resets (when nothing else worked)

• Password reset by CLI: wp user update admin-username --user_pass=newpass --allow-root
• New admin user: wp user create rescue you@mail.com --role=administrator --allow-root
• Deactivate all plugins (the folder-rename trick from the WSOD guide) — a misbehaving plugin is occasionally the loop’s source.

Before you need this guide

Store the hosting panel’s file manager access and an SSH cheat-sheet now — every escape route above assumes file-level access. The free audit includes an access-resilience check: how many independent ways exist to reach your admin when the front door misbehaves.