You type the right username and password, press Log In, and the same login page comes back: empty fields, no error, no dashboard. Your password is not the problem. WordPress did log you in, but the browser never got to keep the login cookie, or kept it for a different address than the one the dashboard lives on, so the dashboard sees a stranger and sends you back. Below is a rebuilt example (not a real client), then the order of steps that gets you back in without breaking anything.
<?php at the top of wp-config.php or a theme's functions.php does exactly this; you would also see "Cannot modify header information - headers already sent by" in the host's error log.wp-config.php and .htaccess with the file manager. Everything below is changed through the host's file manager or phpMyAdmin, because the dashboard is the thing you cannot reach.https://) or moving hosts. In phpMyAdmin, open the wp_options table (the prefix may differ) and read the rows siteurl and home. They must match the address you actually use, exactly: same https or http, same www or no www. If they disagree with each other or with the address bar, the cookie is set for one address and the dashboard checks it on the other.wp-config.php, just above the line that says /* That's all, stop editing! */:
define( 'WP_HOME', 'https://www.example.com' ); define( 'WP_SITEURL', 'https://www.example.com' );using your real address, with no slash at the end. These override the database, and deleting them puts things back. Once you are in, set the same address under Settings, General (the two fields will be greyed out while the lines are there), then you can remove the lines. Do not change the address to one your SSL certificate does not cover.
wp-config.php has a line defining COOKIE_DOMAIN (often left behind by a move or an old multisite setup), put // in front of it and try again./wp-login.php and /wp-admin/ are excluded from caching.wp-content/plugins to plugins-off and try to log in. If it works, rename it back, then rename the plugins' own folders one at a time to find the one causing it. If it does not, rename it back and do the same with the active theme's folder (WordPress falls back to a default theme)..htaccess if the site was moved or a plugin wrote rules into it: rename it to .htaccess-old, log in, then go to Settings, Permalinks and press Save to write a clean one. (On nginx hosts there is no .htaccess; skip this.)wp_users, your row, user_pass, function MD5, a new password); WordPress accepts it once and re-stores it with its stronger hash at your next login. Then fix the email: a site that cannot send a password reset also loses its contact form mail.| What you find | What it means | Usual fix |
|---|---|---|
| Works in a private window, not in your usual browser | An old or broken cookie in that browser | Delete the site's cookies, log in again |
siteurl and home differ (http vs https, www vs none) | The login cookie is set for one address, checked on another | WP_HOME and WP_SITEURL in wp-config.php, then Settings, General |
COOKIE_DOMAIN defined in wp-config.php | The cookie is issued for a domain the site no longer uses | Comment the line out |
| Started after turning on a cache, CDN or Cloudflare rule | A stored copy of the login or dashboard is being served | Purge; exclude /wp-login.php and /wp-admin/ |
| Logs in fine with the plugins folder renamed | A plugin (often security or redirect) is bouncing you | Find it folder by folder; update, reconfigure or replace it |
| "Cookies are blocked" plus "headers already sent" in the error log | Something prints output before WordPress sends the cookie | Remove the blank line or space before <?php in the file the log names |
siteurl and home in the database by guesswork. A typo there takes the whole site down for visitors as well; the two wp-config.php lines are the reversible way.If you can reach the host's file manager, the steps above usually get you back in within half an hour. If you are locked out of the host's panel too, or the site needs to be edited today, that is what the box below is for. Related: "too many redirects" is the same address mix-up taken one step further, and a "critical error on this website" after you get in usually means a plugin or theme update failed.