Locked Out of WordPress Admin? Fix Login, Redirect & Permission Issues

Few things feel worse than typing your password, pressing Enter — and landing right back on the login screen. Your website is fine. Your visitors can see it. You just can't get in. This guide covers every common WordPress login issue, from redirect loops to lost admin roles, in the order you should try them.

Quick answer: most WordPress login problems are caused by cookies, a mismatched site URL, or a security plugin overreacting. Clear your browser cookies for the site, confirm both WordPress URLs match exactly (including https and www), and if a plugin was just installed or updated, deactivate it over FTP by renaming its folder. If you're fully locked out, the password can be reset directly in the database — steps below.

1. Login Page Refreshing and Redirecting (the Login Loop)

You enter the right password, WordPress accepts it, and the login page simply reloads. No error, no dashboard. That's the login loop, and it's a session problem, not a password problem. Work through this list:

1. Clear cookies for your site. WordPress logins live in cookies. Old or conflicting ones from a migration or an SSL change break the session before it starts.
2. Match your site URLs. In Settings → General (or via WP_HOME and WP_SITEURL in wp-config.php), both addresses must be identical — https://example.com and https://www.example.com count as different sites to a cookie.
3. Rule out plugins. Rename the wp-content/plugins folder over FTP and try logging in. If it works, rename it back and deactivate plugins one by one — security and cache plugins are the usual suspects.
4. Purge every cache. A cached copy of the login page can serve you a stale security token. Clear the plugin cache, the server cache, and any CDN like Cloudflare.

2. Locked Out of WP Admin — Getting Back In

If "Lost your password?" emails never arrive (very common — many servers can't send mail reliably), you can reset the password at the database level. It sounds scary, but it's a two-minute job:

1. Open phpMyAdmin from your hosting control panel and select your site's database.
2. Open the wp_users table (the prefix may differ, e.g. wpxx_users) and click Edit on your user.
3. In the user_pass field, type a new strong password and choose MD5 in the Function dropdown, then save.
4. Log in with the new password. WordPress silently upgrades the hash to its modern secure format on first login.

Locked out because a security plugin banned your IP after failed attempts? Renaming that plugin's folder over FTP lifts the ban instantly. And if you were locked out without failing any logins, treat it as a possible hack and read our malware removal guide next.

3. WP Dashboard Missing Functions or Menus

You log in fine — but half the dashboard is gone. No Plugins menu, no Appearance, no Settings. WordPress shows you only what your user role is allowed to see, so missing functions mean your account lost its Administrator capabilities. It happens after migrations, botched security plugin settings, or a hack that quietly demoted you.

• Check your role. In phpMyAdmin, open wp_usermeta, find your user's wp_capabilities row, and confirm it reads a:1:{s:13:"administrator";b:1;}.
• Check the table prefix. After a migration, if the database prefix changed but the capability keys didn't, WordPress can't match your role to the site. The keys must use the current prefix.
• Check for menu-hiding plugins. White-label and client-management plugins hide admin menus on purpose — one wrong checkbox hides them from you too.

4. Image Upload Issues and File Permission Problems

"An error occurred in the upload" or images that upload but show as broken tiles — both come down to whether the server is allowed to write files where WordPress expects. The healthy setup looks like this:

1. Folders: 755. Files: 644. Set these on wp-content/uploads and everything inside it. Never use 777 — it works, and it also hands write access to attackers.
2. Correct ownership. All files should belong to the same user PHP runs as. Sites moved between hosts often end up owned by the wrong user, which permissions alone can't fix.
3. Enough memory. Large photos are resized in memory at upload time. If big images fail while small ones work, raise the PHP memory limit — the exact line is in our WordPress errors guide.
4. ModSecurity false positives. If uploads fail only for certain files, the server firewall may be blocking them. Your host can whitelist the rule in minutes.

5. WordPress Update Issues That Break Access

An update that stalls can leave the site stuck in maintenance mode — every page says "Briefly unavailable for scheduled maintenance." The fix is one file: delete the hidden .maintenance file from your site's root folder over FTP, and the site returns immediately. If the update half-finished and something is now broken, that's a compatibility problem — our plugin and theme conflict guide shows how to pin down which piece failed.

Still Locked Out? We'll Open the Door

Everything above is safe to try yourself. But if the database looks alien to you, or you suspect the lockout wasn't an accident, don't experiment on a live business site. At WordPressFix we recover locked admins, rebuild corrupted roles, fix permission issues and clean up whatever caused it — 24/7, usually within hours.

Start the HELLO FIX live chat in the bottom-left corner, or email hello@wordpressfix.org with your URL and what you see when you try to log in.

WordPress Login FAQs

Keep Reading

• Fix WordPress errors: 500, database, fatal & memory errors
• Find and fix plugin & theme conflicts (including Elementor)
• Fix WooCommerce cart, checkout & shop page problems
• Site slow or hacked? Speed optimization & malware removal
• Hacked? Manual malware removal & security monitoring service
• WordPress speed optimization service — before/after reports
• WordPress migration & backup — zero-downtime host or domain moves
• The complete website repair & WordPress fix guide