WordPress Login Page Not Working? Fix the Errors That Stop You Before wp-admin

Key Takeaways

• When the WordPress login page is not working, the exact message on the screen points to the cause: a wrong password error, a "Cookies are blocked" error and a silent reload each need a different fix.
• The WordPress login form sets a test cookie first, so a browser that blocks cookies gets the "Cookies are blocked or not supported by your browser" error even when the password is correct.
• The WordPress Address (URL) and Site Address (URL) fields in Settings > General must match the real domain and protocol, because a wrong value sends the login page into a redirect loop.
• WordPress core has no login lockout of its own, so messages such as "login temporarily disabled" come from a security plugin or the host, and renaming that plugin's folder removes the block.
• With WP Adminify's Redirect URLs setting (Pro) active, /wp-login.php returns a 404 on purpose and the login form moves to the custom address you chose, such as /client-login.

A WordPress login page not working is almost always one of six problems: a password WordPress will not accept, blocked cookies, a login page that reloads or redirects, a security lockout, a 404 at wp-login.php, or a blank page. Each one shows a different message, so read the screen first. This guide covers problems that happen before you get into the dashboard.

If you can log in but the dashboard is blank, slow or stuck, read the sibling guide on the WordPress dashboard not loading instead. For every other case where wp-admin is not working, start with the main troubleshooting guide. At the end you will also see how a custom login URL and Loginfy, the login page addon for WP Adminify, help keep the login screen stable.

Quick Checks Before You Change Any Files

Most WordPress login issues can be narrowed down in two minutes without touching the server. Open the login page in a private window, then in a second browser. If it works there, the cause is your browser: old cookies, a cached page or an extension. If it fails everywhere, the cause is on the site, and the error text tells you where to look.

1. Open the login page in a private window, then on a phone using mobile data. This also shows whether your IP address is blocked.
2. Clear cookies for your domain and turn off ad blockers for the site.
3. Write down the exact error text and match it to a section below.

WordPress Says the Password Is Incorrect

The message "The password you entered for the username is incorrect" means WordPress found the user but the password does not match. The fastest fix is the Lost your password link, which emails a reset link. If email does not arrive, reset the password from the server with phpMyAdmin or WP-CLI, which needs no email at all.

Check Caps Lock and the keyboard language first, and type the password by hand once, because a password manager may fill an old one. If the reset email never arrives, reset the password on the server:

• With WP-CLI, run wp user update client.owner --user_pass="NewStrongPassword" from the site folder, using your own username.
• In phpMyAdmin, open the wp_users table, edit your user row, set user_pass to a new password with the MD5 function, and save. WordPress replaces the hash with a stronger one the next time you log in.

Our guide on how to change or reset a WordPress admin password walks through five methods that work without email. WordPress.org also has its own page on how to reset your password.

"Cookies Are Blocked or Not Supported by Your Browser"

This error means the browser did not send back the test cookie that WordPress sets on the login page. WordPress shows it instead of a password error, even when the password is right. The fix is to allow cookies for your domain, clear old ones, and make sure the site address matches the address in your browser bar.

The login form posts the fields log, pwd, wp-submit, redirect_to and a hidden testcookie. WordPress sets wordpress_test_cookie when the form loads and checks that it came back. After a good login, the wordpress_logged_in_ cookie keeps you signed in. Check these causes in order:

1. Allow cookies for the domain in your browser settings, or test in another browser.
2. Check the address. If you open the www address but WordPress uses the address without www, the cookie is set for the wrong host. See the next section.
3. Check caching. A page cache or CDN that stores the login page serves an old form, so exclude the login page from the cache.

The Login Page Refreshes or Redirects Back

A login page that reloads after you submit the right password, or sends you to the homepage, is a redirect loop. The most common cause is a WordPress Address or Site Address that does not match the real domain, such as http instead of https or a missing www. Other causes are stale cookies, a caching plugin and a bad .htaccess rule.

You cannot reach Settings > General when the loop stops you logging in. Set the two addresses in wp-config.php instead. Add these lines above the line that says "That's all, stop editing!":

1
2define( 'WP_HOME', 'https://example.com' );
3define( 'WP_SITEURL', 'https://example.com' );
4

Use your real domain with the same https and www choice as your SSL certificate. Then clear your cookies, turn off any caching plugin, and re-save Settings > Permalinks.

A login loop has more causes than this one, including SSL behind a proxy and role-based redirects. Our full guide to the WordPress login redirect loop covers each fix in order.

"Login Temporarily Disabled" and Other Lockout Messages

WordPress core does not lock anyone out after failed logins. Messages such as "login temporarily disabled", "too many failed login attempts" or "this feature is temporarily forbidden for security reasons" come from a security plugin or from your host's firewall. The lock usually ends after a set time, but you can remove it sooner with file access.

1. Connect with FTP or your host's file manager.
2. Open wp-content/plugins and rename the security plugin's folder, for example add -off to the end. WordPress deactivates it.
3. Log in, then rename the folder back and activate the plugin again.
4. Add your own IP address to the plugin's allowlist so it does not happen again.

If you see the message without failing any logins, bots are trying passwords on your site, often called a login flood. Keep the limiter on. Behind a proxy or CDN, make sure the plugin reads the real visitor IP, or it may lock out everyone at once. If renaming plugins does not help, only your host can remove the block. To pick a limiter, compare the best WordPress login security plugins.

The Login Page Shows a 404 Error

A 404 at /wp-login.php usually means a custom login URL is active. Plugins that move the login page make the old address return "not found" on purpose, so bots cannot find it. If you forgot the new address, deactivate the plugin by renaming its folder. If wp-login.php itself is missing, upload a fresh copy from WordPress.org.

We tested this with the Redirect URLs setting in WP Adminify (Pro), under Adminify > Security > Redirect URLs. With the New Login URL set to client-login and Redirect Admin set to 404:

• /wp-login.php returned a 404;
• /client-login showed the normal WordPress login form;
• a logged-out visit to /wp-admin/ went to /404.

All three results are expected. If you forget the new address, rename the adminify-pro folder in wp-content/plugins (and adminify too if needed). The default /wp-login.php comes back. You can read more about this feature on the WP Adminify Login URL and Redirects page, and about the trade-offs in our guide to change the WordPress login page URL.

If no plugin moves the login URL, check that wp-login.php exists in the WordPress root folder and upload a fresh copy if needed. Then rename .htaccess to .htaccess-old, and re-save Settings > Permalinks to create a clean file.

The Login Page Is Blank or Shows a Critical Error

A blank white login page, or the message "There has been a critical error on this website", means PHP stopped on a fatal error before the form could load. A plugin or theme is the usual cause. Rename the wp-content/plugins folder over FTP to turn off every plugin at once, then load the login page again.

1. Rename the plugins folder to plugins-off. If the login page now works, a plugin is the cause. Rename it back and test plugin folders one at a time.
2. If plugins are not the cause, rename your active theme's folder. WordPress falls back to a default theme.
3. Still blank? Turn on debug logging and read the error. In wp-config.php, replace the line define( 'WP_DEBUG', false ); with these three lines.

1
2define( 'WP_DEBUG', true );
3define( 'WP_DEBUG_LOG', true );
4define( 'WP_DEBUG_DISPLAY', false );
5

Remove the old line first. On our test site, a second WP_DEBUG line only printed the warning "Constant WP_DEBUG already defined", and debug mode stayed off.

The error is written to wp-content/debug.log and names the file that failed. WordPress explains each constant in its debugging guide. For memory errors and other causes, follow our WordPress white screen of death guide. Turn debug mode off when you are done.

The Login Button Does Nothing or Shows 403

When you click Log In and nothing happens, a script error or a browser extension is usually blocking the form. When you see "403 Forbidden" instead of the form, the server or a firewall is blocking access to wp-login.php. Test in a private window first, then turn off plugins, and check .htaccess and file permissions for a 403.

• If the button does nothing, try a private window with extensions off. If that works, an extension is the cause. If not, rename the plugins folder and switch to a default theme.
• For a 403 Forbidden error, look in .htaccess for Deny from or Require rules, set files to 644 and folders to 755, and ask your host about its firewall.

How to Stop Login Problems Coming Back

Most repeat login problems come from bots that hit wp-login.php and trigger lockouts, or from changes that break the login page without warning. Four habits prevent most of them. Limit login attempts, add a CAPTCHA or two-factor login, move the login URL, and keep a record of who changed what.

• Limit login attempts and allowlist your own IP.
• Add reCAPTCHA or two-factor authentication. The Loginfy login page customizer adds reCAPTCHA to the login form and lets you choose from 16 templates, your logo, background and form styles. It can also change the login error messages, which our guide to WordPress login error messages explains.
• Move the login URL and save the new address in your password manager.
• Keep an activity log. The Activity Logs addon records logins and changes to posts, plugins and settings, so you can see what changed before the login broke.

For the full design walkthrough, see how to customize the WordPress login page.

Frequently Asked Questions

Final Thoughts

When the WordPress login page is not working, start with the message on the screen. A wrong password needs a reset. "Cookies are blocked" and a reloading page point to the test cookie and the two site addresses. Lockouts come from a security plugin, a 404 usually means the login URL moved, and a blank page is a PHP error. Once you are in, protect the screen with reCAPTCHA and a custom design from Loginfy. If something else in wp-admin fails, the full guide WordPress Admin Not Working? How to Fix Every wp-admin Problem covers it.

Related Reading

• WordPress Dashboard Not Loading After Login? Fix a Blank, Slow or Stuck wp-admin
• WordPress Login Redirect Loop: 9 Fixes for WP-Admin
• Reset a WordPress Admin Password: 5 Ways Without Email