Can’t Log In to WordPress Admin? How to Get Back In

If you can’t log in to WordPress admin, the login page usually does one of three things: it refreshes and drops you back on the form, it rejects a password you’re sure is right, or it tells you you’re locked out. In most cases the cause is stale cookies, a security plugin, a wrong site URL, or a plugin that broke the login process.

Work out which symptom you have, then jump to the matching fix. None of these steps delete content.

Start here: match the symptom

• The page reloads with no error, or loops back to the login form: cookies, caching, or a site URL mismatch.
• “The password you entered is incorrect” or “Unknown username”: reset the password.
• “Too many failed login attempts” or an access denied page: a security plugin or your host’s firewall has blocked you.
• /wp-login.php or /wp-admin/ shows a 404: a plugin has moved your login page to a custom URL.
• You log in and get a blank page or “There has been a critical error”: a plugin or theme error. See our guide to the WordPress critical error.

Login page refreshes: clear cookies first

WordPress keeps you logged in with cookies. If your browser blocks them or holds an old, broken set, the login form accepts your password and then sends you straight back to it.

1. Open a private or incognito window and try to log in there. If it works, the problem is in your normal browser.
2. In your normal browser, clear cookies and cached files for your site’s domain only. You don’t need to wipe everything.
3. Turn off browser extensions that block cookies or scripts for your domain, then try again.

Also check that you’re using the exact address WordPress expects. Logging in at http://example.com/wp-admin/ when the site is set to https://www.example.com can set the cookie for the wrong address, and you get bounced.

If the login page is being served from a page cache or CDN, it can loop too. Purge all caches and make sure wp-login.php and /wp-admin/ are excluded from caching. Our guide on how to clear WordPress cache covers every layer.

Check the site URL

WordPress stores its own address in two settings, WordPress Address (URL) and Site Address (URL). If one is wrong after a migration, a domain change or a switch to HTTPS, logins often fail silently or end in a redirect loop. You can’t reach Settings → General to fix it, so override them in wp-config.php instead.

Connect with SFTP or your host’s file manager, open wp-config.php in the site root, and add these lines above the one that says /* That's all, stop editing! */, using your real address with no trailing slash:

define( 'WP_HOME', 'https://www.example.com' );
define( 'WP_SITEURL', 'https://www.example.com' );

Clear your cookies and log in. These lines override the database values, so once you’re in you can correct the fields in Settings → General and then remove the two lines, or leave them in place. If the browser says the page “redirected you too many times”, see our too many redirects guide.

You can also fix the values directly in phpMyAdmin: open the wp_options table (your prefix may differ from wp_) and edit the siteurl and home rows.

Wrong password or username

Use the Lost your password? link under the login form. If the reset email never arrives, your site probably has an email delivery problem, and fixing that comes first.

When email isn’t an option, you can set a new password through phpMyAdmin or WP-CLI. Our step-by-step guide to reset a WordPress password walks through both. With WP-CLI it’s one command:

wp user update yourusername --user_pass='a-new-long-password'

If you don’t know your username, run wp user list, or look in the wp_users table in phpMyAdmin. You can log in with your email address too.

Locked out by a security plugin

Security plugins such as Wordfence, Limit Login Attempts Reloaded and Solid Security block an IP address after several failed attempts. Most lockouts expire on their own after a set time.

• Wait out the lockout, then log in carefully with a password manager.
• Try from a different network, such as your phone’s hotspot. Lockouts are usually tied to your IP address.
• Check the lockout screen for a way to regain access. Some plugins can email a link to the admin address that lifts the block.
• If you lost your two-factor device, the steps below to disable the plugin work for that too.

To get in right away, disable the plugin by renaming its folder. In SFTP or the file manager, go to wp-content/plugins/ and rename the plugin’s folder, for example wordfence to wordfence-off. WordPress can no longer find it, so it stops running. Log in, rename the folder back, reactivate the plugin under Plugins, and clear its lockout list in its settings.

If renaming the plugin changes nothing, your host’s firewall may be blocking your IP. Ask your host to check and unblock it.

Forgot your custom login URL

Plugins like WPS Hide Login, and the hide backend feature in some security plugins, move the login page to a custom address. The usual /wp-login.php then returns a 404 or redirects to the homepage.

Check your password manager and the email where you saved the setup details first. If you can’t find it, rename that plugin’s folder in wp-content/plugins/. The default /wp-login.php works again. Log in, rename the folder back, reactivate the plugin, and write the custom URL down somewhere safe.

Still stuck: disable all plugins

If none of the above applies, a plugin may be breaking the login process. Rename the whole wp-content/plugins folder to plugins-off, then try to log in.

If that gets you in:

1. Rename the folder back to plugins.
2. Go to Plugins. WordPress will report that your plugins have been deactivated because their files were missing.
3. Reactivate them one at a time, testing the login in a private window after each one. The plugin that breaks it again is the culprit.

With WP-CLI you can do the same with wp plugin deactivate --all. The method is the same one we use to troubleshoot a plugin conflict. If plugins aren’t the cause, rename your active theme’s folder in wp-content/themes/ so WordPress falls back to a default theme, as long as one such as Twenty Twenty-Five is installed.

Keep it from happening again

• Store your username, password and any custom login URL in a password manager.
• Keep the admin email address current and make sure your site can send email, so password resets arrive.
• Keep a second administrator account for a trusted person, with its own strong password.
• Exclude the login page and admin area from page caching and CDN caching.
• Keep current backups, so a bad change can be undone quickly.

Still stuck?

If you still can’t get into your dashboard, our $79 one-time fix gets you back in, usually within 24 hours, and it’s fixed or your money back. If lockouts and login problems keep coming back, our Care Plans include monitoring, backups and a developer to call on.