What causes WordPress to keep logging you out?
If WordPress keeps logging you out, the problem is usually not your password.
It is often a mismatch in site URLs, a cookie issue, a browser problem, or a configuration conflict that breaks authentication sessions.
WordPress relies on login cookies, consistent domain settings, and a stable browser session to keep you signed in.
When any part of that chain fails, you may get pushed back to the login screen after a refresh, a page change, or a short period of inactivity.
Check your WordPress Address and Site Address
The most common cause is a mismatch between the WordPress Address (URL) and Site Address (URL).
These settings must match exactly in scheme and domain, including http versus https and www versus non-www versions.
To verify them, go to Settings > General in the WordPress dashboard.
Both fields should point to the same preferred version of your site.
For example, choose one of these patterns and use it consistently:
- https://example.com
- https://www.example.com
If you can access the dashboard, update the values there and save.
If you cannot stay logged in long enough, you may need to set the URLs in wp-config.php using WP_HOME and WP_SITEURL.
When should you edit wp-config.php?
Edit wp-config.php when the dashboard changes do not stick, when an SSL migration is incomplete, or when a plugin keeps rewriting the URL settings.
Adding the following constants can force WordPress to use the correct domain:
define('WP_HOME', 'https://example.com');
define('WP_SITEURL', 'https://example.com');Replace the example domain with your real canonical URL.
Use the same protocol your site actually serves, preferably HTTPS.
Clear browser cookies and cache
WordPress stores authentication data in browser cookies.
If those cookies are stale, corrupted, or blocked, the login session can fail repeatedly.
Start by clearing cookies and cache for your site only, then test again in a fresh browser window.
If the issue disappears, the problem is likely browser-side rather than WordPress itself.
- Clear cookies for your domain
- Disable private browsing extensions temporarily
- Try another browser such as Chrome, Firefox, or Edge
- Make sure your browser is not blocking first-party cookies
If you use a strict privacy extension, ad blocker, or security plugin in the browser, it may interfere with WordPress login cookies and create the appearance of a server issue.
Confirm SSL and HTTPS settings
A mixed setup between HTTP and HTTPS is another frequent reason for session loops.
If your login page loads over HTTPS but your WordPress URLs, admin links, or redirects still point to HTTP, WordPress may treat the session as invalid.
Check your SSL certificate and make sure the entire site redirects to one preferred version.
Also confirm that your hosting provider or CDN is not rewriting secure requests in a conflicting way.
Look for these common problems:
- HTTPS enabled on the front end but not in WordPress settings
- A valid SSL certificate missing on the root domain or subdomain
- Cloudflare or another proxy forcing a redirect loop
- Incorrect reverse proxy or load balancer configuration
If you recently migrated from HTTP to HTTPS, resave your permalinks and confirm that all internal URLs and admin URLs now use the secure version.
Disable plugins and test for conflicts
A plugin conflict can break login sessions, especially security, caching, membership, or redirect plugins.
These plugins may modify cookies, alter authentication headers, or interfere with admin requests.
To test safely, deactivate all plugins and then try logging in again.
If the issue stops, reactivate plugins one at a time until the logout problem returns.
The last plugin enabled is the likely cause.
Plugins that commonly affect logins
- Security plugins such as Wordfence or iThemes Security
- Cache plugins such as WP Super Cache or LiteSpeed Cache
- Membership and LMS plugins
- Redirect and URL management tools
- Single sign-on and authentication plugins
If you cannot access the dashboard, rename the plugins folder through FTP or your hosting file manager to disable everything at once.
Then restore the folder name after testing.
Switch to a default theme
A faulty theme can also trigger login issues, especially if it contains custom authentication code, aggressive redirects, or outdated functions.
Although this is less common than URL or cookie problems, it is worth checking.
Temporarily switch to a default WordPress theme such as Twenty Twenty-Four or another current default theme.
If the logout behavior stops, the active theme likely contains the conflict.
Pay special attention to custom code in functions.php, login redirect snippets, and theme-based membership logic.
Theme-specific changes can unintentionally break session handling.
Review security and caching layers
Server-side cache, object cache, browser cache, and CDN cache can all affect login behavior.
WordPress admin pages should generally bypass caching, because cached login pages or cached cookies can produce invalid sessions.
Check the following:
- Exclusions for
/wp-admin/,/wp-login.php, and authenticated users - Page cache rules that prevent caching logged-in sessions
- Redis or Memcached object cache settings
- CDN settings that cache HTML or rewrite cookies
If you use Cloudflare, test the site with development mode or bypass cache rules.
If your host provides server caching, ask whether admin requests are excluded from cache by default.
Verify server time, cookies, and browser domain consistency
WordPress login sessions depend on accurate time and consistent domain handling.
If your server time is wrong, or if your site is accessible through multiple domains without a canonical redirect, login cookies may not persist correctly.
Make sure the server time zone is accurate and synchronized.
Also ensure the site uses one primary domain, not several competing variants.
For example, do not leave both the apex domain and the www version accessible without a clean redirect strategy.
Consistency matters for:
- Domain name
- Protocol
- Cookie scope
- Redirect behavior
- Canonical URLs
Reset .htaccess or permalinks
On Apache servers, a damaged .htaccess file can interfere with redirects and admin access.
A simple permalink refresh often resolves strange login behavior after migration or plugin changes.
Go to Settings > Permalinks and click Save Changes without editing anything.
This regenerates rewrite rules.
If you cannot reach the dashboard, temporarily rename the .htaccess file and let WordPress generate a new one after login.
For sites on Nginx, check the server configuration for redirect loops, especially if you recently added HTTPS rules or a proxy layer.
Use a fresh admin session and test carefully
Sometimes the problem is limited to one browser profile, one device, or one user role.
Test with a private window, a second browser, and another administrator account if available.
This helps isolate whether the issue is global or local.
When testing, observe exactly when the logout occurs:
- Immediately after login
- After refreshing the page
- After opening wp-admin
- After inactivity
That pattern can point to the cause.
Immediate logout often suggests URL or cookie mismatch, while delayed logout may indicate caching, security rules, or session expiration settings.
Ask your host to check advanced authentication issues
If you have already checked URLs, cookies, plugins, themes, and cache, the problem may be at the hosting layer.
Shared hosting, managed WordPress platforms, firewalls, WAF rules, and reverse proxies can all interfere with authentication.
Ask your hosting support team to review:
- Server logs for repeated login failures
- Firewall or ModSecurity blocks
- Proxy headers such as
X-Forwarded-Proto - PHP session handling
- SSL termination behind a load balancer
These details matter because WordPress may believe a request is insecure or unauthenticated when the hosting stack is rewriting traffic unexpectedly.
Quick troubleshooting checklist
- Match WordPress Address and Site Address exactly
- Confirm HTTPS is configured consistently
- Clear browser cookies and cache
- Disable plugins and test for conflicts
- Switch to a default theme
- Exclude admin pages from caching
- Refresh permalinks and check .htaccess
- Verify server time, domain, and proxy settings
Using this checklist in order usually reveals the cause of WordPress session problems quickly, especially after a migration, SSL change, or plugin install.