What this problem looks like
WordPress sets authentication cookies for the URL defined in siteurl. If you log in at https://www.example.com but siteurl is https://example.com, cookies may not stick and you loop forever.
Redirect loops also follow bad HTTPS rules in .htaccess, reverse proxy headers, and security plugins that force SSL on wp-admin incorrectly.
Step 1: Clear cookies and test private browsing
Old http cookies conflict after SSL migration. Clear site data in browser settings or use a private window. Try both www and non-www URLs to see which loops.
Step 2: Fix siteurl and home in the database or wp-config
In phpMyAdmin, open wp_options and set siteurl and home to your live https URL. Or open wp-config.php in your site root, next to wp-admin and wp-content, and override with:
define( 'WP_HOME', 'https://www.example.com' );
define( 'WP_SITEURL', 'https://www.example.com' );Step 3: Fix HTTPS detection behind proxies
Behind Cloudflare or a load balancer, WordPress may think the request is http. Add to wp-config.php when your host documents it:
if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https' ) {
$_SERVER['HTTPS'] = 'on';
}Step 4: Deactivate security and redirect plugins
Rename wp-content/plugins to plugins.disabled via File Manager, SFTP, or FTP. If the loop stops, rename plugins.disabled back to plugins, then deactivate Really Simple SSL, Wordfence, iThemes Security, and custom redirect plugins one at a time in wp-admin until you find the cause.
Step 5: Audit .htaccess redirect rules
Find .htaccess in your site root, next to wp-admin and wp-content. Duplicate HTTPS and www rules cause loops. Keep one canonical redirect chain. Temporarily rename .htaccess to test whether server rules conflict with WordPress.
When to stop DIY and hire help
Login loops on live shops waste orders every minute. BugShield fixes WordPress login and HTTPS cookie issues at a confirmed fixed price.