Guide
How to fix WordPress login problems
Most WordPress login problems come from a wrong password, blocked cookies, a redirect loop caused by wrong site addresses, or a security plugin locking you out. Start with the password reset link, clear cookies and caches, then check the site addresses and disable plugins by renaming their folder. Our live chat (open 24/7) can help if you are still locked out.
Quick diagnosis
Match the symptom to the likely fix
| What you see | Likely cause | First thing to try |
|---|---|---|
| Incorrect password or username message | Typing error or forgotten details | Use the lost password link |
| Password reset email never arrives | Wrong address, spam folder or mail sending problem | Check spam, then reset via the database |
| Page reloads and shows the login again | Cookies, caching or wrong site URL | Clear cookies and check site addresses |
| Cookies are blocked error | Browser settings or a plugin error | Allow cookies, try another browser |
| Too many failed attempts message | Login protection triggered | Wait, or whitelist your address |
| White or blank screen after login | Plugin or theme error | Disable plugins by renaming the folder |
| Redirected to the wrong domain | Site address settings are wrong | Correct them in wp-config.php |
First checks
Rule out the simple things first
Before assuming something is broken, check the basics. Make sure you are using the right address, which is normally your domain followed by /wp-admin/ or /wp-login.php. A security plugin or a developer may have moved the login page to a custom address, so check any notes or emails from whoever built the site. Confirm that caps lock is off and that your password manager is filling in the right account, since many people have several logins for several sites.
Try a private browser window. If you can log in there, the problem is something stored in your normal browser, such as old cookies or a browser extension that interferes with forms. Clear cookies for your site, or try another browser. Also check the date and time on your device. Login cookies depend on time, and a badly wrong clock can make them expire at once.
If the site uses a page cache, make sure the login page is excluded. Good caching plugins do this automatically, but a misconfigured cache can serve a stale login page to everyone, which makes logins appear to fail. Purge the cache and try again.
Forgotten password
Resetting a lost password
Use the lost password link
On the login page, click the link under the form, and enter your username or email address.
Check spam and junk folders
The reset email comes from your site. If it is not in your inbox, look in spam, and confirm the address is correct.
Use your hosting database tool
If no email arrives, open the database tool in your control panel, find the users table, edit your user row and set a new password using the MD5 option, then log in and change it again.
Choose a strong new password
Use a long, unique password from a password manager.
Fix the email problem
If reset emails did not arrive, set up reliable email sending so notifications from your site are delivered.
Locked out and stuck?
Live chat is open 24/7. Give us your domain and what you see.
Loops
The login page keeps reloading
A login that accepts your details and then drops you back at the login form is a classic sign of a cookie or address problem. WordPress sets a cookie when you log in and checks it on the next page. If the address in your browser differs from the address stored in settings, for example www against non-www, or http against https, the cookie does not match and you are treated as logged out.
Check the WordPress Address and Site Address values. If you cannot reach the dashboard, you can set them in wp-config.php with the WP_HOME and WP_SITEURL lines, using the exact address your visitors use, including https. Remove those lines once things are working if you want the dashboard to control them again. Make sure that your SSL certificate is active and that there is only one redirect rule from http to https, because duplicate redirect rules from a plugin and the server can create a loop.
Caching can also cause this. Exclude wp-login.php and the admin area from any page cache, and clear your browser cookies. If you recently moved the site, our migration guide and HTTPS guide cover address and redirect settings in more detail.
Plugins
Is a plugin or your account to blame?
Points to a plugin
- The problem began after an update or install
- A security plugin shows a lockout message
- The error mentions a plugin file
- Other users can log in but you cannot
- Renaming the plugins folder fixes it
Points to your account or browser
- Only one browser or device fails
- A private window works
- The password reset also fails
- Your user role was changed
- Cookies or the clock are wrong
Lockouts
Getting back in when a plugin has locked you out
Open the file manager or SFTP
Log in to your hosting control panel or connect with an SFTP client.
Go to wp-content
Find the plugins folder inside the wp-content folder of your site.
Rename the plugins folder
Change plugins to plugins-off. This deactivates every plugin at once.
Try logging in
If you can now log in, rename the folder back and go to the Plugins screen. They will be listed as deactivated.
Re-activate one by one
Turn them back on individually until the problem returns, then you have found the cause.
Adjust or replace it
Review the plugin's login protection settings or replace it with a better one.
Security
Login problems that could be an attack
Sometimes repeated login failures are not your fault at all. Automated tools constantly guess usernames and passwords on WordPress sites. You may notice many failed login notices, a slow site or an account lockout you did not trigger. This is usually brute force noise, and a strong password, two-factor login and limits on login attempts stop it.
More worrying signs include a changed administrator email, unknown users with the administrator role, or your own password not working when you are sure it is right. If you suspect an account has been taken over, reset via the database as above, change the passwords of all administrators, check the user list and follow the steps in our WordPress security guide.
Our servers include Imunify360, a ModSecurity firewall and DDoS protection on every plan, which filter a great deal of hostile traffic before it reaches your login page. Contact live chat if you think an attack is in progress and we can check the account.
Other causes
Less common login problems
Database connection error
If the site cannot reach its database, nobody can log in. Check the details in wp-config.php.
Corrupt core files
A broken update can damage login files. Reinstall WordPress core from the dashboard or a fresh download.
Full disk or quota
When there is no space for sessions or temporary files, logins can fail. Free some space.
Wrong file permissions
After a move, files may have unsuitable permissions. Standard permissions are 644 for files and 755 for folders.
Two-factor problems
If you lose your authenticator, use your backup codes or disable the plugin using the folder rename trick.
Wrong server time
Cookie validity depends on correct time. Check your device clock first.
Prevention
How to avoid future lockouts
- Store passwords in a password manager
- Keep an up to date administrator email
- Save two-factor backup codes somewhere safe
- Create a second administrator account
- Whitelist your own address in login protection
- Document any custom login URL
- Keep backups so you can roll back
- Test logins after updates and moves
Still locked out
When to ask for help
If you have tried the steps above and still cannot log in, do not keep guessing passwords, which may trigger more lockouts. Gather what you know: your domain, the exact error message, what changed and when, and whether the problem affects one user or everyone. That information lets us find the cause much faster.
Contact our live chat (open 24/7) or open a ticket. If a recent change broke the site and you have a backup, we can help you restore a copy from before the problem. See the white screen of death guide if you see a blank page instead of a login error.
Hosting with help whenever you need it
Live chat open 24/7 and weekly remote backups on every plan.
FAQ
Common questions
Why does WordPress say my password is wrong when it is right?
Check for typing errors, caps lock, browser autofill and the correct username. If it still fails, reset the password.
How do I log in if I lost my email access?
Reset your password from the database tool in your hosting control panel, or ask our live chat for guidance.
What is the WordPress login address?
Normally your domain followed by /wp-admin/ or /wp-login.php, unless a plugin changed it.
Will deleting plugins delete my content?
No. Your posts and pages are in the database. Renaming the plugins folder only deactivates plugins.
Can I stop attackers guessing my password?
Use a strong unique password, two-factor login and limits on login attempts.
Keep reading
Related pages
Get WordPress hosting with live support
Live chat open 24/7 on every plan.