You are writing a post or editing a page and a box says "Your session has expired. Please log in to continue where you left off." Or you log in, click twice, and you are back at the login screen. WordPress normally keeps you logged in for two days (fourteen with Remember Me ticked), so being thrown out every few minutes means something is cutting the login short. Below is a rebuilt example (not a real client), a five-minute check, and the fix for each cause.
https and www. Then look at your browser's address bar while you are logged in. If any of the three differ (one has www., another does not), that is the most common cause (row 1).| What you see | Why it happens | The fix |
|---|---|---|
| Logged out after a few clicks, often right after you follow a link or save | The site answers on two addresses (with and without www, or http and https). WordPress stores your login for one address; a link or a redirect takes you to the other, which has never heard of you. Common after adding SSL or moving hosts | Make WordPress Address and Site Address identical and use the address people actually type, then have the host redirect the other version to it. If the two boxes are greyed out, they are set in wp-config.php:define( 'WP_HOME', 'https://www.example.com' ); define( 'WP_SITEURL', 'https://www.example.com' );Correct both lines there. If COOKIE_DOMAIN is also in that file and names a different address, remove it unless a developer set it on purpose. Take a backup first: a typo in these lines locks everyone out (see login page keeps reloading) |
| It happens on your computer only; a colleague or a private window stays logged in | The browser throws the login cookie away: "clear cookies when the window closes", strict tracking protection for this site, or a privacy or cookie-cleaning extension | Add your site to the browser's list of sites always allowed to keep cookies, or turn off the extension for your site. Tick Remember Me on the login form |
| Logged out after the same number of minutes every time, even while typing | A security or "inactive logout" plugin ends logins after a set time. Some count minutes since you logged in, not since you last clicked | Raise the limit (an hour or two is reasonable for the people who write content) or turn the feature off for administrators and editors. Keep a limit on shared office computers if that was the reason it was switched on |
| Logged out whenever you move between Wi-Fi and phone data, or turn a VPN on or off | A security setting ties each login to the internet address it started from. Phones, VPNs and some office connections change that address during the day | Turn off the "lock session to IP address" style setting in the security plugin or the host's panel, or exempt administrators. Two-step login protects the account better than an address lock does |
| Everyone is logged out at once, every few days or after each plugin update | The secret keys in wp-config.php (AUTH_KEY, LOGGED_IN_SALT and the rest) are being replaced. Changing them logs everybody out, which is right once after a break-in. Some security plugins are set to change them on a schedule, and a deploy script or host tool can rewrite them on every update | Find what changes them (the security plugin's "salts" or "secret keys" setting, or the deploy process) and set it to change only when you ask. Do not edit the keys by hand unless you mean to log everyone out |
| The dashboard works, but the front of the site shows you logged out (no black admin bar) or shows an old version of a page | A page cache (a caching plugin, Cloudflare "Cache Everything", or the host's cache) served you a copy saved for visitors. You are not really logged out | In the cache settings, skip the cache for logged-in users and never cache /wp-admin/ or wp-login.php. On Cloudflare, add a rule that bypasses the cache when the wordpress_logged_in_ cookie is present. See changes not showing |
Lost a draft when the box appeared? Open the post again: WordPress usually says "There is an autosave of this post that is more recent than the version below" with a link to restore it. Older copies are under Revisions in the post's settings panel.
Matching two addresses or changing one timeout takes a minute. Untangling a site that answers on four addresses after a host move, a security plugin that rewrites the keys, or a Cloudflare rule that caches the dashboard is where most owners would rather have someone do it. If that is you, the box below is for that. Related: login page keeps reloading, too many redirects and lost access to the site.