Can't Log In to wp-admin? 8 Causes and Safe Fixes (2026)

You open your site to publish a new post, type /wp-admin, and the login page keeps reloading. Or you enter a password you are sure is right and WordPress says it is wrong. Sometimes it is worse: a completely blank white page. Being unable to log in to wp-admin scares a lot of people, but most cases can be fixed without reinstalling anything.

This guide covers the common causes and fixes, ordered from things you can do in the browser to editing files and the database. Start at the top and work down. Do not jump straight to editing the database.

Before touching files or the database: always take a backup from your hosting control panel first.

Identify Your Symptom

Cause 1: Cookies and Browser Cache

WordPress uses cookies to remember that you are logged in. If an old cookie is stuck, or your browser blocks cookies, the login succeeds but you are sent straight back to the login page.

Try in order:

1. Open a private/incognito window and log in again
2. Try another browser or device
3. Clear cookies for your site’s domain only
4. Temporarily disable ad-blocking or privacy extensions

If incognito works, the problem is your usual browser, not the site.

Cause 2: A Caching Plugin or CDN Is Caching the Login Page

If a caching plugin or CDN caches wp-login.php or /wp-admin/, you see an old page with no logged-in state.

• Purge the cache in your host’s control panel and your CDN (for example, Purge in Cloudflare)
• Exclude /wp-admin/* and wp-login.php from caching
• If you cannot reach the dashboard at all, disable the caching plugin by renaming its folder (see Cause 8)

Cause 3: Site URL Mismatch (Redirect Loop)

This is the main cause of “too many redirects”. It usually happens after changing hosts, changing domain or installing SSL, when the WordPress Address and Site Address do not match the real URL. For example, they say http while the server forces https, or there is a www mismatch.

To fix without the dashboard, open wp-config.php in File Manager or via SFTP and add these lines (with your real domain) above “That’s all, stop editing”:

define( 'WP_HOME', 'https://www.example.com' );
define( 'WP_SITEURL', 'https://www.example.com' );

Also check:

• If you use Cloudflare, look at the SSL mode. Flexible combined with a server that forces HTTPS can loop. Full or Full (strict) is usually correct.
• Check the redirect rules in .htaccess for overlapping http/https and www/non-www rules. If you recently moved domains, see how to change domain without losing SEO.

Once you are back in, correct the values under Settings > General. You can then remove the two lines or leave them.

Cause 4: Forgotten Password or No Reset Email

The first option is “Lost your password?” on the login page, but many sites never set up email sending, so the reset link never arrives. Try:

1. Check your spam folder
2. If your host offers WordPress Toolkit or a similar WordPress manager in the control panel, it often has a button to reset the admin password directly
3. Use phpMyAdmin: open the wp_users table (the prefix may not be wp_), edit the user_pass field for your account, choose the MD5 function and enter a new password. WordPress converts it to a stronger hash the next time you log in.

Once you are in, set up SMTP email so you can reset passwords yourself next time.

Cause 5: Locked Out by a Security Plugin or Firewall

Plugins such as Wordfence, Solid Security or Limit Login Attempts, or your host’s firewall, block IPs after repeated wrong passwords. You see a lockout message or a 403 page.

• Wait for the lockout period. Some plugins release automatically.
• Switch networks, for example from Wi-Fi to mobile data. If that works, your original IP is blocked.
• Use the email unlock link, if the plugin offers one
• Temporarily disable the security plugin by renaming its folder in wp-content/plugins/. Once in, rename it back and remove your IP from the block list.
• If the block is at host or Cloudflare level, unblock it from that control panel

Do not forget to re-enable the security plugin. Leaving it off makes the site riskier than before.

Cause 6: You Changed the Login URL and Forgot It

Many sites hide the login page with a plugin such as WPS Hide Login or a feature in a security plugin, so /wp-admin and /wp-login.php return 404.

• Search your email or handover documents for the custom URL
• Ask whoever built or maintained the site
• If you cannot find it, rename the folder of the plugin that hides the login and the URL returns to the default

This is exactly why details like this belong in your handover documents from the day you hire a developer (see our checklist for hiring a WordPress developer).

Cause 7: The Admin Account Was Changed or Hacked

If the password is correct but you still cannot get in, your account has vanished, or you log in without admin menus, someone may have changed roles or the site may be compromised. Warning signs:

• Unknown administrator accounts in the wp_users table
• The admin account email has been changed
• The site redirects visitors elsewhere or shows strange links
• Plugins you did not install

What to do immediately:

1. Change your hosting, database and SFTP passwords first
2. Check the wp_users and wp_usermeta tables for unfamiliar accounts (do not delete anything you are unsure about)
3. Restore from a backup taken before the compromise, if you have one
4. Once in, update everything, delete unused plugins and enable 2FA

If you suspect a hack, a real clean-up means checking both files and database. Changing passwords alone is rarely enough, because an attacker may already have planted a backdoor.

Cause 8: White Screen or Error 500

If /wp-admin shows a white screen or Error 500, it is usually a PHP error in a plugin or theme, or not enough memory.

1. Go to wp-content/, rename the plugins folder to plugins-off and try the dashboard
2. If it works, rename it back and reactivate plugins one at a time to find the culprit
3. If not, rename the active theme’s folder in wp-content/themes/. WordPress falls back to an installed default theme.
4. Turn on the debug log in wp-config.php to see the actual error

Detailed steps for isolating plugins and reading the debug log are in WordPress plugin not working: step-by-step fixes.

What Not to Do When You Are Locked Out

• Do not reinstall WordPress over the top without a backup. You may lose content.
• Do not drop database tables just because an online guide says so
• Do not try passwords dozens of times. The firewall will block you for longer.
• Do not send hosting passwords to strangers in public chats
• Do not forget to undo temporary changes, such as renamed folders or debug mode

Avoid Locking Yourself Out Again

When to Get Help

If you have worked through these steps and still cannot get in, do not have hosting access, or suspect a hack, stop and let someone experienced take over. Experimenting with the database when unsure can do more damage.

The Southern Whale freelance team helps businesses in Southern Thailand regain admin access, check for signs of intrusion and harden their WordPress sites, both as one-off fixes and through ongoing website maintenance. Send us the symptoms and a screenshot on LINE OA.

Frequently Asked Questions

Why do I get sent back to the login page after logging in?

Usually stuck cookies, a cached login page, or a site URL that does not match the real URL (http/https, www). Try incognito first, then check WP_HOME and WP_SITEURL.

Is it safe to reset the password through phpMyAdmin?

Yes, if you only edit the user_pass field of the correct account and back up the database first. If your host has a WordPress management tool, that is easier.

How long does a security plugin lockout last?

It depends on the plugin’s settings: a few minutes for some, several hours for others. If you are in a hurry, switch networks or temporarily disable the plugin by renaming its folder.

Will renaming the plugins folder delete my data?

No. Plugin settings live in the database. When you rename the folder back and reactivate, your settings are still there.

Does being locked out of wp-admin affect SEO?

If the public site still works, rankings are not directly affected. But if the cause is a redirect loop or Error 500 affecting the whole site, Google cannot crawl it, so fix it quickly. See what to do when your website is down.

I suspect a hack. What should I do first?

Change your hosting, database and SFTP passwords, then back up the current state as evidence. After that, check the files and user accounts, or have a specialist inspect the site.