What this problem looks like
WordPress sets authentication cookies for the URL defined in siteurl. If you log in at https://www.example.com but siteurl is https://example.com, cookies may not stick and you loop forever.
Redirect loops also follow bad HTTPS rules in .htaccess, reverse proxy headers, and security plugins that force SSL on wp-admin incorrectly.
Step 1: Clear cookies and test private browsing
Old http cookies conflict after SSL migration. Clear site data in browser settings or use a private window. Try both www and non-www URLs to see which loops.
Step 2: Fix siteurl and home in the database or wp-config
In phpMyAdmin, open wp_options and set siteurl and home to your live https URL. Or override in wp-config.php:
define( 'WP_HOME', 'https://www.example.com' );
define( 'WP_SITEURL', 'https://www.example.com' );Step 3: Fix HTTPS detection behind proxies
Behind Cloudflare or a load balancer, WordPress may think the request is http. Add to wp-config.php when your host documents it:
if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https' ) {
$_SERVER['HTTPS'] = 'on';
}Step 4: Deactivate security and redirect plugins
Rename folders for Really Simple SSL, Wordfence, iThemes Security, and custom redirect plugins in wp-content/plugins/. Reload wp-login after each test.
Step 5: Audit .htaccess redirect rules
Duplicate HTTPS and www rules in .htaccess cause loops. Keep one canonical redirect chain. Temporarily rename .htaccess to test whether server rules conflict with WordPress.
When to stop DIY and hire help
Login loops on live shops waste orders every minute. BugShield fixes WordPress login and HTTPS cookie issues at a confirmed price with secure Vault access.