Why does my WordPress login page keep refreshing?

Usually the login cookie does not stick. The most common reasons are a mismatch between the site address and the address you use (http/https or www), a cache or CDN that caches the login page, or a plugin redirect.

What does “Cookies are blocked or not supported by your browser” mean?

WordPress tried to set a test cookie and did not get it back. It can be your browser, but often it is a caching layer, a wrong cookie domain in wp-config.php or output sent before the headers by a broken plugin.

Can you reset my admin password without the email?

Yes, with hosting or database access we can set a new password or create a new admin account directly, and then look at why the email did not arrive.

I think someone else changed my password. What now?

Then the site may be hacked. Change the hosting, database and SFTP passwords, and have the site checked for added admin users and malicious files. A new password alone does not remove a backdoor.

Will my content be affected?

No. Login problems do not touch posts, pages or orders. We back up the files and database before changing settings anyway.

Why does WordPress say my password is wrong when I am sure it is right?

Check that you use the right username or email address first, then that no password manager fills in an old password. If a security plugin counts failed attempts, repeated tries can also trigger a lockout. If the password truly stops working without a reason, treat it as a warning sign and check for unknown admin users.

Is ‘wp-admin not working’ the same as ‘cannot log in’?

Not always. If wp-admin shows an error such as the critical error message or a 500 error instead of a login form, the problem is in the site’s code, not in your login. The fix then starts with the error log instead.

WordPress login problem

WordPress login not working: why you cannot get into wp-admin

The short answer

You are probably not locked out for good. A mismatched site address, a cookie that does not stick or a security lockout is far more common than a lost password. And your content is not affected.

Get it fixed

Backup before every change
Fixed price before we start
Remote, anywhere in the world
Free diagnosis

Start with what you see. A page that simply reloads points to the site address or cookies. A block message points to a security plugin or your host’s firewall. A reset email that never arrives is a mail problem on the server. Each has a different fix, and in most cases we can reach the cause through hosting or database access in one session. If admin users appear that you did not create, that is a different matter: see the hack question below.

Sound familiar?

Signs your WordPress login is not working

After entering your password, the login page simply reloads, or you end up back at wp-login.php
You see “Error: Cookies are blocked or not supported by your browser”
The login page shows “too many failed attempts” or a block message from a security plugin
The “Lost your password?” email never arrives
Your password suddenly no longer works, or there are admin users you do not recognise

Causes

Why you cannot log in to WordPress

Site address does not match

The WordPress Address and Site Address (siteurl and home) point to http instead of https, or to www instead of non-www. The login cookie is set for one address and the redirect goes to the other, so you are sent back to the login page.

Cookies blocked or stripped

A browser setting, a cache plugin or a CDN rule removes or caches the login cookie, which gives the “cookies are blocked” error or a silent reload.

Security plugin lockout

Wordfence, iThemes/Solid Security, Limit Login Attempts or a host firewall blocked your IP after failed attempts, or a changed login URL means wp-admin no longer leads anywhere.

.htaccess, caching or CDN interference

Redirect rules, a full-page cache or a CDN that caches /wp-admin or /wp-login.php serve an old page instead of logging you in.

Reset email does not arrive

The server cannot send mail reliably, mail lands in spam, or the account email address is outdated, so you cannot reset the password yourself.

Admin account changed by an attacker

On a compromised site, attackers often change passwords, demote your account or add their own admin. That needs a cleanup, not just a new password.

Try it yourself

Getting back into wp-admin yourself

Try these steps first. They are safe and do not change your content.

1 Open the login page in a private window, or clear cookies for your domain only, and try again. Make sure you use the exact address of the site, including https and www if the site uses them.
2 Go directly to yoursite.com/wp-login.php. If a security plugin changed the login URL, look for that address in old emails or the plugin documentation.
3 If you are locked out after failed attempts, wait the lockout period or try from another network, such as mobile data. Your host can also check whether its firewall blocks your IP.
4 Check that siteurl and home are correct: in phpMyAdmin, table wp_options, or by adding define('WP_HOME', ...) and define('WP_SITEURL', ...) with the correct https address to wp-config.php.
5 Temporarily rename the folder of your security or cache plugin in wp-content/plugins via SFTP or the file manager, then try to log in again.
6 If the reset email does not arrive, check spam first. Your host may let you set a new password through phpMyAdmin or WP-CLI (wp user update).
7 If you see admin users you do not know or your password was changed, do not just reset it. Treat the site as possibly hacked and change your hosting and database passwords too.

Our approach

How we restore your WordPress login

1

You tell us what happens

Describe what you see when you log in and since when, through the form or chat. We reply with the access we need.
2

We back up first

We copy the files and the database before we change any setting, user or plugin, so everything can be reverted.
3

We find the cause and quote

We check the URL settings, cookies, redirects, security and cache layers and the user table, and send you a fixed price before we fix anything.
4

We fix, test and report

After your approval we restore access, test logging in from a clean browser and send a short report, including any accounts we found that you should know about.

What we need

What we need from you

Login for your hosting control panel, or SFTP/SSH access
Access to phpMyAdmin or the database, usually through the hosting panel
CDN or Cloudflare access, if you use one
The exact error text, the address you use to log in and what changed recently

We ask for the minimum access, create our own temporary account where possible, and you can revoke everything as soon as you can log in again.

What we cannot fix

We cannot get into a site when nobody has hosting, SFTP or database access, recover accounts at a third-party login service you use, or fix outages at your host. If the domain or hosting account itself is lost, you need to recover that first with the provider, and we tell you which steps to take.

Price

Price and what happens next

1

Free diagnosis

We find the cause and tell you what is wrong.
2

Fixed price

You get a price and a time estimate. Nothing starts without your yes.
3

Fixed and reported

We repair it, test it and send a short report.

From €295 excl. VAT

Fixed price, agreed before we start

Is it urgent? Say so in the form or in the chat. We start as soon as we can and give you a realistic time estimate with the quote. If priority work costs extra, you see that in the quote before you agree.

Get it fixed

Questions?

WordPress login not working: FAQ

Also see

Tell us what is wrong

Answer a few short questions. You get a fixed price before we do anything.

Step 1 of 5

On which platform are you experiencing the problem?

Website App Software

WordPress login not working: why you cannot get into wp-admin

Signs your WordPress login is not working

Why you cannot log in to WordPress

Site address does not match

Cookies blocked or stripped

Security plugin lockout

.htaccess, caching or CDN interference

Reset email does not arrive

Admin account changed by an attacker

Getting back into wp-admin yourself

How we restore your WordPress login

You tell us what happens

We back up first

We find the cause and quote

We fix, test and report

What we need from you

What we cannot fix

Price and what happens next

Free diagnosis

Fixed price

Fixed and reported

WordPress login not working: FAQ

Related problems

Redirect loop

Hacked website

WordPress critical error

Tell us what is wrong