WordPress Login Not Working? How to Fix Login Loops, Lockouts and Lost Passwords

On this page

1. WordPress login not working: match the symptom to the cause
2. Step 1: rule out the browser
3. Step 2: fix login loops caused by the site URL
4. Step 3: get past a security plugin lockout
5. Step 4: reset a lost password when the email never arrives
6. Step 5: blank screens and errors after you log in
7. When a lockout is really a security problem
8. Prevent the next lockout
9. When to call for help
10. Quick check: rule out cookies and plugins in two minutes
11. When to get help
12. FAQs

If your WordPress login is not working, the cause is almost always one of four things: browser cookies or cache, a wrong WordPress or site address, a security plugin that has locked you out, or a password reset email that never arrives. Start with a private browser window, then check the site address, then disable plugins by renaming their folder in your hosting file manager. Those three steps fix most cases in a few minutes without touching the database.

This guide walks through each symptom in order, from the simplest check to the deeper fixes, so you can get back into wp-admin safely. If you would rather not touch files at all, ongoing WordPress maintenance and support covers exactly this kind of problem.

WordPress login not working: match the symptom to the cause

Before changing anything, note exactly what happens when you try to log in. The symptom points to the cause much faster than guessing.

What you see	Most likely cause	First thing to try
Login page reloads with no error (login loop)	Cookies, cache or a wrong site URL	Private window, then check WordPress Address and Site Address
"Cookies are blocked or not supported"	Browser settings, caching of the login page, or URL mismatch	Clear cookies for the site, exclude wp-login.php from caching
"Too many failed attempts" or IP blocked	Security or limit-login plugin	Wait for the lockout to expire or rename that plugin folder
Password reset email never arrives	Site email not set up properly (no SMTP)	Check spam, then reset the password via hosting or phpMyAdmin
Blank white screen or critical error after login	Plugin or theme PHP error	Rename the plugins folder, read the error log
wp-admin redirects to the homepage or a 404	Custom login URL plugin or broken rewrite rules	Disable the login-hiding plugin, reset permalinks

Step 1: rule out the browser

Open the login page in a private or incognito window and try again. If that works, the problem is stored cookies or cached files in your normal browser. Clear cookies and cache for your domain only (not your whole browser history) and log in again.

Also check:

• You are using the same version of the address every time: https and the right www or non-www form. Cookies set for one version don't apply to the other.
• A password manager hasn't saved an old password or autofilled the wrong username.
• Browser extensions that block cookies or scripts are paused for your own site.

If a private window fails in the same way, the problem is on the site, so move to the next step.

Step 2: fix login loops caused by the site URL

A login page that simply reloads is very often a site address mismatch: WordPress thinks it lives at http://example.com while you are visiting https://www.example.com, so the login cookie is set for the wrong address. This typically happens after installing SSL, moving hosts or changing the domain.

If you can't reach Settings, you can force the correct address in wp-config.php, the main configuration file in your site's root folder. Add these two lines above the line that says "That's all, stop editing", using your real address:

define( 'WP_HOME', 'https://www.example.com' );
define( 'WP_SITEURL', 'https://www.example.com' );

Log in, check that both addresses are correct under Settings, General, and then you can remove the lines or leave them in place. If the site was recently moved to HTTPS, read how to fix too many redirects as well, because the same mismatch often causes redirect loops on the front end.

Caching can cause loops too. A server cache, a CDN or a caching plugin should never cache wp-login.php or wp-admin. Most hosts exclude these by default, but a custom CDN rule can catch them. If you use Cloudflare or a similar service, purge its cache and check that no page rule caches everything.

Step 3: get past a security plugin lockout

Security plugins limit failed login attempts, which is good, but they can also lock out the owner after a few wrong passwords, or block an office IP address shared by many people. Most lockouts expire after a set time. If you can't wait:

1. Log in to your hosting control panel and open the file manager (or connect by SFTP).
2. Go to wp-content/plugins and rename the security plugin's folder, for example by adding "-off" to the end.
3. Log in to WordPress normally. The plugin is now inactive.
4. Rename the folder back, reactivate the plugin and add your own IP address to its allow list if it offers one.

The same rename trick works for login-hiding plugins that move wp-admin to a custom address you have forgotten. If you are not sure which plugin is responsible, rename the whole plugins folder, log in, rename it back and then reactivate plugins one at a time. The method is described in more detail in troubleshooting WordPress plugin conflicts.

Step 4: reset a lost password when the email never arrives

"Lost your password?" only works if your site can send email. Many WordPress sites send mail through the hosting server's basic PHP mail function, which often lands in spam or is rejected outright. Check spam first. If nothing arrives, you have three other ways to reset the password:

• Your hosting panel. Many Indian and international hosts, including Hostinger, offer a WordPress manager with a "change admin password" option.
• phpMyAdmin. Open the wp_users table (the prefix may differ), edit your user, choose MD5 in the function column for user_pass, type a new password and save. WordPress upgrades the hash to a stronger one the next time you log in.
• WP-CLI. If your host provides SSH access, the command wp user update with your username and a new password does the same job in one line.

After you are back in, fix the underlying email problem by sending site mail through a proper SMTP service. Email deliverability with SPF, DKIM and DMARC explains why mail goes missing and how to stop it.

Step 5: blank screens and errors after you log in

If the password is accepted but you then see a white screen or "There has been a critical error on this website", a plugin or theme is crashing in the admin area. WordPress usually emails a recovery mode link to the admin address; if that email doesn't arrive, rename the plugins folder as above. To see the actual error, turn on debug logging in wp-config.php and read wp-content/debug.log. Our guide to the WordPress critical error covers this in depth, including memory limits and PHP version problems.

When a lockout is really a security problem

Sometimes the login fails because someone else has been in. Warning signs include an admin account you don't recognise, your own account demoted to a lower role, your email address changed, or the site redirecting visitors to spam. Don't just reset your password in that case. Change all admin passwords, remove unknown users, check the site files and update everything, then follow how to know if your WordPress site has been hacked. If the site has clearly been compromised, hacked site repair is the safer route than guessing.

Prevent the next lockout

Once you are back in, a few small changes stop this happening again:

• Create a second administrator account with a different email address, kept for emergencies.
• Store passwords in a password manager and turn on two-factor authentication. How to secure your WordPress login explains the options.
• Set up SMTP so password reset emails actually arrive.
• Keep the hosting control panel login safe and separate; it is your back door when WordPress fails.
• Take regular backups so you can restore a working version if an update breaks the admin area.

When to call for help

If you have tried a private window, checked the site URL and disabled plugins and still can't log in, the problem is likely in the database, server configuration or a deeper conflict. At that point an hour with someone who works on WordPress daily is usually faster and safer than trial and error on a live business site, especially if it is your main source of enquiries. You can hire a WordPress developer in India for a one-off fix, or work with a WordPress developer in Pune if you prefer someone in the same city.

Quick check: rule out cookies and plugins in two minutes

1. Try logging in from a private browser window. If that works, clear cookies for your domain in your normal browser.
2. If it still fails, open your hosting file manager and rename wp-content/plugins to plugins-off. Try logging in again.
3. If login now works, rename the folder back and reactivate plugins one by one to find the one that blocks login.

When to get help

Get help when you see unknown admin users, when the admin email has changed, or when renaming plugins does not restore access. Those can point to a hack, which needs WordPress malware removal. For login and access fixes with prevention afterwards, see WordPress maintenance and support, or send the details through the contact form.

FAQs

Why is my WordPress login not working even with the right password?

The usual causes are cookies that the browser can't save, a site address mismatch after an SSL or domain change, cached login pages, or a security plugin that has blocked your IP. Try a private window first, then check the WordPress Address and Site Address settings.

How do I fix a WordPress login redirect loop?

Clear cookies for the site, make sure you always use the same https and www version of the address, set WP_HOME and WP_SITEURL in wp-config.php if needed, exclude the login page from any cache, and disable plugins by renaming their folder to find a conflict.

How can I reset my WordPress password without email?

Use your hosting panel's WordPress tools, edit the user in phpMyAdmin with an MD5 password, or use WP-CLI over SSH. Afterwards, set up SMTP so future reset emails are delivered.

I am locked out by a security plugin. What do I do?

Wait for the lockout period to pass, or rename that plugin's folder in wp-content/plugins using your hosting file manager. Log in, rename it back, reactivate it and add your IP to its allow list.

Can a hacked site stop me logging in?

Yes. Attackers sometimes change the admin email, delete or demote accounts, or add their own. If you see unknown users or strange redirects, treat it as a hack: change every password, clean the site and check how they got in.