Resolving The WordPress Multisite Redirect Loop

Though I do the majority of my work using single site WordPress installs, there are a number of sites and projects in which I’ve used WordPress multisite and there’s a problem that I’ve experienced specifically with using WordPress multisite, subdomains, and shared hosting environments.

Specifically, the problem is this:

  • Install WordPress and activate multisite
  • Configure the installation to use subdomains (versus subdirectories)
  • Attempt to login and get stuck in a redirect loop

If you have a single instance of WordPress multisite installed on the same server, there’s no issue, but if you go beyond that then you normally hit a problem: a redirect loop.

The WordPress Multisite Redirect Loop

The WordPress Login Screen
The most frustrating screen ever (in a redirect loop, that is).

Once you’ve increased the number of your multisite installs beyond one, then you’re likely to be unable to login as you’ll get stuck in a redirect loop. That is, every time you try to login, you’re returned to the login screen.

Luckily, the fix is relatively easy.

In your wp-config.php file, add the following lines of code:

define('ADMIN_COOKIE_PATH', '/');
define('COOKIE_DOMAIN', '');
define('COOKIEPATH', '');
define('SITECOOKIEPATH', '');

And do so just before the line that reads:

/* That's all, stop editing! Happy blogging. */

Once done, the redirect issue should be resolved.

Why Does This Happen?

Whenever you’re running multiple versions of WordPress on the same server, you can visualize the setup like this:

WordPress Multisite Installation
WordPress Multisite Installation

Basically, each version of WordPress, regardless of its domain or subdomain, maps to a single IP address. In this case,

When a request comes into the server, part of the request includes the domain. A domain is associated with an IP address. When a cookie is created, it includes the name, some sensitive content, and then the path.

For example:

NAME = wordpress_d676ec21cf050e966685794aa715694f
CONTENT = removed
PATH = /sitename/wp-admin

In a WordPress Multisite setup a cookie for two sites may look like this:

NAME = wordpress_d676ec21cf050e966685794aa715694f
PATH = /sitename/wp-admin

NAME = wordpress_d676ec21cf050e966685794aa715694f
PATH = /sitename/

Notice that the name of the two cookies above are exactly the same but the path’s are different. This is because two different sites with different domains are hosted on the same IP address, and they both exist in the cookie because the cookies aren’t being reset.

Cookies Being Set By WordPress
Cookies being set for the different sites on the same domain.

As such, when you attempt to login to a WordPress installation on a different domain (but on the same IP), the cookie is essentially invalid.

Thus, WordPress – in the most technical term possible – wigs out.

But more seriously, wp-login doesn’t attempt to look for cookies before actually setting them. This means that an invalid cookie is being used and since it doesn’t attempt to clear the existing cookies, you get stuck in the login loop.

Thus, the big picture looks something like this:

WordPress Multisite and Cookies
WordPress Multisite and Cookies

Sure, clearing the cookies will do the trick, but users shouldn’t have to do that. Additionally, not everyone will see this problem occur, but if you’re in the business of managing a multisite installation in a shared environment, then you’re likely to see it.

The code above will ensure that WordPress is clearing the cookie for the given domain of the multisite thus allowing the login process to set it correctly.

195 Replies to “Resolving The WordPress Multisite Redirect Loop”

  1. Thanks so much for posting this, I’m anxious to try it on an issue I’ve been having after a Multisite migration attempt. I’ve migrated a Multisite install to another domain for dev-ing and am getting this redirect.

    Hopefully this will solve the issue for me:)

      1. Hi Tom,
        I am having this issue with the new install of WP 3.6.
        I installed fresh, activated multi-site, and created a new site. I am woring with sub-folders. Now it is giving me the redirect error:

        The page isn’t redirecting properly

        Firefox has detected that the server is redirecting the request for this address in a way that will never complete.

        This problem can sometimes be caused by disabling or refusing to accept

        I tried using the code you suggested and it isn’t working. I’m thinking it’s because you were working with sub-domains instead of the sub-folders.
        Do you have any suggestions? It has been awhile since you posted on this, so I thought you may have figured something out.
        Thank You!

        1. Unfortunately, I’ve got nothing in addition to the content mentioned here as this is what’s ended up solving my issue.

          If you end up solving it on your end, feel free to leave it in the comment stream here just in case it may help others :).

  2. I had similar problem with a sub-directory WPMS setup. mine would come up with a browser error of too many redirects. I had already tried clearing cookies and cache.

    This fix solved it! Thank you!

  3. I also had a cookie problem on a subdirectory install of multisite. One point to mention and i’m not sure why this occurred but WP didn’t like this line:

    define(‘COOKIE_DOMAIN’, ”);

    Once i removed that line from wp-config.php it seemed to still fix the problem.

    Any thoughts?

    1. This could be a result of a number of things. The post is specifically targeting a common problem that I’ve seen with multisite.

      Unfortunately, I can’t offer much more than what’s above, but if you happen to come to a resolution, feel free to share it here for future readers.

  4. Thanks that really helped! I don’t really follow why this is a problem on local and not on a live server, which will also have the same IP for each site?

    Secondly, as I’d like to maintain one set of code that works on live and local, can the 4 paths exist in the LIVE config file, or will this break logins there?

    1. Thanks that really helped! I don’t really follow why this is a problem on local and not on a live server, which will also have the same IP for each site?

      That is odd as I normally see it the other way around :). I was going to double-check about the IP issue on the server, but if it’s not a problem there then it may simply be a result of the routing mechanism setup on the server (unless you’re on a run-of-the-mill host).

      Secondly, as I’d like to maintain one set of code that works on live and local, can the 4 paths exist in the LIVE config file, or will this break logins there?

      The most critical paths are in the database, so if you have different paths for your siteurl and home values in the wp_options table, then you’re out of luck. =T

  5. Greetngs Tom, and thanks for all the information which has been provided above.

    We have applied the changes above, but it has yet not resolved our error. For we have a setup such that and The login for works correctly, but the login for gives an error.

    We have tested, the configuration for both the blogs from the admin console, we have tested all the php files which are the same except for a few obvious changes.

    Any inputs or pointers will be appreciated.

    1. Hey Saurab,

      Unfortunately, there may not be much more can I offer. What error does the login for give? Make sure that that user has been granted permission in the main multisite admin panel – sometimes that can cause an error.

      1. Hi, I should have stated it more correclty. My mistake. The login on does not give an error but redirects to the /wp-login.php without any error as such. No message on the screen. Just verified that the user has been added to and has adequate permissions.

        One more funny thing which I observed, is if i go to the main blog and navigate to my list of blogs, and click on the blog, it opens the blog for me. Then I type /wp-admin at the end as in and press enter. I am taken to the dashboard.

        Thanks and appreciate any help you can give me. Frankly can use any help I get.

        1. Unfortunately, this sounds like more complicated of a problem that I can provide via blog comments, but I’d double-check your .htaccess file, your wp-config.php file, clear your cookies, and disable any caching plugins if you have them.

          I’d also recommend trying to login with another browser and see if the problem persists there, too. If it does, then the problem definitely exists on the server so that’s the next place I’d start looking.

  6. A BIG thank you to you!!! forums have 2-3 years old discussions about this with no real solution. I had to google this and visit an external site, wow!

  7. Thank you for documenting the solution to a very difficult problem. It worked for me, twice!

    Your solution worked until I installed the domain mapping plugin “wordpress-mu-domain-mapping”. It required me to comment out the second line:
    define('COOKIE_DOMAIN', '');

    I didn’t know it at the time because I was still logged in but that inevitably broke my setup because after a reboot, I could not login. The redirect loop was back! My sites were all rendering when visited by the subdomain url but I could not login to any of them.

    I came back to your post and tried to remove the comment the COOKIE_DOMAIN line and then everything broke. The solution I came up with was to remove the network activation of the “wordpress-mu-domain-mapping” plugin using phpMyAdmin. Once the plugin was removed, sunrise.php removed from wp-config.php and the COOKIE_DOMAIN line back in action, I was in business. It worked.

    My head is spinning after editing…

    wp-config.php in WordPress
    hosts file on Windows 7
    httpd.conf in the WAMP Apache config
    httpd-vhosts.conf in the WAMP Apache config
    and .htacess in the virtual host setup…

    it’s quite complicated.

    Thanks again for your continued dedication to the WordPress community.

    1. I had the same problem. It existed prior to installing the MU Domain Mapping Plugin.

      Adding these did fix the problem.

      1 define(‘ADMIN_COOKIE_PATH’, ‘/’);
      2 define(‘COOKIE_DOMAIN’, ”);
      3 define(‘COOKIEPATH’, ”);
      4 define(‘SITECOOKIEPATH’, ”);

      but the 2nd line “define(‘COOKIE_DOMAIN’, ”);” is incompatible with the MU domain mapping plugin. It makes you take out the line, and soon as I do, the login loop problem comes back. What does this mean? Is the plugin basically crippled at this point?

      My setup is:
      a clean fresh install of WordPress 3.5.2 and
      Version of MU Domain Mapping.

      1. Unfortunately, I can’t offer much advice here as I don’t use the domain mapping plugin – I’ve just made those modifications to my `wp-config.php` (in a multisite install) and it was all I needed.

        Wish I could be more help.

        1. Yeah setting COOKIE_PATH to empty string can cause issues with plugins that use cookies.
          I had issues with the Easy digital downloads cart after doing this.
          setting it to forward slash solved it though

  8. This was a very helpful post. I found that once I included this in wp-config.php, I could finally log into wp-admin. Once I got in, though, it was forcing me to log in again to each site when switching from dashboard to dashboard. So once I had logged into each dashboard, I found that I could remove these constants and everything started working normally.

    1. Literally had the same problem, this worked like a charm. I spent about 6 hours looking for the right way to Google the issue. These are my new favorite 4 lines of code.

  9. Hi there,

    i recently asked my developer to transfer all 7 of my wordpress websites into one multisite.

    The main site is which is like a ‘quick view’ portfolio site.

    I then have different sites for different products linking from this site for example

    My developer has set up the domain as that seem to redirect to

    I’m not sure, but I believe that Google does not like re-directs for SEO etc so I was wondering if it it possible to set up multisite without using

    Any feedback or advice would be greatly appreciated.

    Many thanks,

    Tommy (:

  10. I implemented the code but I still have the redirect problem. The domain in question is not the main domain of my hosting account. I mean, I purchased the hosting service with “”. Several months after, I setup the “” as an add on domain via cpanel. This is the domain that is causing me the redirect loop when I create the new multisite “site” with the address “”

    Do you think that being “” an add on domain in my main account is causing this solution not to work?

  11. HELP !
    I set up an NGINX+Wordpress+W3 thingy on AWS free tier and then activated multisite (sub directories, no sub domains). Then while trying to access the newly created site’s dashboard, got stuck in the redirect loop. Also the new site looks horrible. Implemented your fix. Didn’t work. Configured the NGINX config file to chew out the www part and used rewrite ^(.*)$1 permanent; to sort out any non-www vs www problems for multisite. Also in wp-config, just left the define(‘MULTISITE’, ‘true’); part and commented out the extra load given by WP while setting up multisite to avoid confusion with www and non-www. All these failed. Need help :(

    1. Hey mk,

      Unfortunately, there’s not much more support than I can offer than what’s included in the post above.

      If I were in your position, I’d start back from ground zero and completely turn off multisite, clear your cookies, and follow each step one-by-one.

      Other than that, that’s the best I can do =T.

  12. Thanks so much! I spend hours on trying to solve this and read about a dozen other forums threads trying to find a solution, but nothing worked. Your solution finally does.

    Just one thing I want to add. I also tried clearing the cookies, cache, using a different browser etc., but I was still getting the loop. So I’m happy that is does work, but your explanation why doesn’t make sense to me in this case.

    Thanks again!

  13. Hi ! i have some time dealing with this problem, and i can’t fix it yet, i try your solution, but it’s not work for me, do you have another advice, or some point that i’ve missed ?

    thanks for share !

  14. I was also having this issue and I couldnt fix it with the solution displayed here. Anyway, I checked the php log file and I saw it was a problem with two specific tables not being created in the wordpress install: wp_blogs and wp_sitemeta. It seems like wordpress MultiSite checks these two tables on loading.

    This may seem far from being the real solution to this problem but it was my specific case. Thanks.-

  15. Hey tom, i am facing same problem, but the solution provided didnt worked for me. May be one of the reason could be that i forgot to add blog.dir folder in my wp-content at the time of enabling multi site

  16. Hi there,

    I have similar problem with my WP multisite install under Nginx box.

    every I visited my domain, it always redirected to the signup page with link look likes

    I have tried your solution by modifiying wp-config.php, but it returned this message, every I visit my domian

    The constant “COOKIE_DOMAIN” is defined (probably in wp-config.php). Please remove or comment out that define() line.

    I’d appreciate anyone who can help me resolve this issue

    1. Had the same problem, and my current server configuration was a little complex so I added a somewhat simple solution. I redirected to through nginx adding another server directive like so
      server {
      listen 80;
      return 301 $scheme://$request_uri;

  17. Adding to reports that these steps broke my WPMU setup… resulted in a white screen with:

    “The constant “COOKIE_DOMAIN” is defined (probably in wp-config.php). Please remove or comment out that define() line.”

    Removing that line, so it just says
    define(‘ADMIN_COOKIE_PATH’, ‘/’);
    define(‘COOKIEPATH’, ”);
    define(‘SITECOOKIEPATH’, ”);

    works great.

    Thanks so much Tom

  18. Tom! Please excuse my previous emails. But I believe I have a solution.

    Domain mapping is case sensitive. So will work, but will have a redirect loop.

    I hope this helps someone, and thanks for your work on this issue.

  19. Tom, thanks so much. Great fix. One thing to note. With WordPress 3.8 this issue doesn’t occur with subdomains ( and because wordpress sets the cookie-domain to “” enabling single signon between the two. But it sure as heck does happen when you have 2 sites in a mult-site wordpress installation like and

    Thanks again

    1. Ditto. I used the “Fubfolder Example WordPress 3.0 through 3.4.2” htacess template on my 3.9.1 install (has been upgraded through versions and not sure what about that means you have to use different htaccess rules)…

      … but anyway those htaccess rules fixed a similar redirect loop issue for me on a subfolder multisite setup.

      1. Thank you Jason!

        Your post helped me resolve the same issue today because it was not clear (to me) what version of the .htaccess file I should use. I knew I was working with an older WordPress install, but I was not certain how old.
        Now running the current WordPress Version 3.9.1 and I recently converted it to multisite with subfolders and got stuck in the “too many redirects” loop with the first sub-site I installed. It required the .htaccess file for “WordPress 3.0 through 3.4.2” and that did the trick.

        Thanks to Tom for originating this useful topic. The discussion is still helpful over a 18 months later. -Cheers

  20. Thanks! I was setting up multisite for a Magento integration, and was near pulling my hair out as I had everything set up correct, but kept getting this login redirect loop. The code worked like a charm even with no modifications necessary. Running multisite in a subfolder install under magento, so that’s two htaccess files to consider. Thanks again!

  21. Ran into this today with a client site. He installed a security plugin which added:
    define('FORCE_SSL_LOGIN', true);
    define('FORCE_SSL_ADMIN', true);

    to his WP-CONFIG.PHP file caused a loop since he didn’t have a cert installed for his domain.

    Also, on my own multisite install I had a loop issue until I fixed the permissions/ownership on .htaccess as I created it when logged in as ROOT and forgot to fix it when I was done.

  22. My programmer is trying to convince me to move to .net from PHP.
    I have always disliked the idea because of the costs. But he’s tryiong none
    the less. I’ve been using Movable-type on numerous websites for about a year and
    am worried about switching to another platform.
    I have heard fantastic things about Is there a way I
    can import all my wordpress posts into it? Any kind of help would be really appreciated!

    1. My programmer is trying to convince me to move to .net from PHP. I have always disliked the idea because of the costs. But he’s tryiong none the less.

      When you’re talking about the costs, are you talking about the costs that you’d incur moving something from one architecture to another (that is, paying someone to port an application)?

      I mean, the licensing for .NET for commercial products is pretty expensive itself so there’s one argument against it; however, I used to do .NET, too and was happy with the environment so I’m playing devil’s advocate more than anything else.

      Is there a way I can import all my wordpress posts into it? Any kind of help would be really appreciated!

      Unfortunately, I don’t know about moving from WordPress to another system as I’m 100% focused on WordPress these days.

  23. Also ran into this issue, added in the supplied code but the redirect loop kept occurring. Managed to get it fixed in the end though!

    I read elsewhere that ‘localhost:80’ wont work WP multi-site, so I tossed a domain in my hosts file (let’s say to point to

    After that, I went through all of the WP database tables, replaced any “localhost:80” occurrences I found with “”. Then update define(‘DOMAIN_CURRENT_SITE’, ‘’) in wp-config.php, restart my webserver… and voila.

    The above probably only applies to rookies like me that were dealing with localhost and just kind of derping along.

  24. Solution for my problem with WPMU Domain Mapping without using the COOKIE_DOMAIN fix in the UK at least.

    Watch out for incompatible domain names basically… Try a traditional format one. e.g instead of

    Some browsers (Google) appear to be rejecting new style domains it seems confusing them with TLD’s I think.


  25. Tom,
    Thank you, Thank you, Thank you! I have been playing with this for a week. I gave up, went back to single site and decided to give it one more go. I wouldn’t have been able to have a multi site network without your expertise so I sincerely thank you.

  26. But you can make an informed decision which makes all
    difference. However, there are many ways of getting a sun tan,
    and the Sun Laboratories Self Tanner Buy enables you to explore one of them.
    The finest self-tanning product manufacturers have a range of tanning creams, lotions, and sprays that you could try to see which
    suit you best.

  27. Hello !

    I’m using Networks for WordPress plugin so I have many networks.
    Despite they all using the same database and user credential. When a user login from network1 and visit another Network2 he need to login again..

    I’m looking for days to find a solution to fix that so user can have a one global login.
    I started to look for cookies solutions and I found your blog.. You think your solution will work consider the information i just gave ?

    Thanks a lot !


  28. Found a solution !!!
    adding this the my config.php
    // Cookies
    define( ‘COOKIEHASH’, md5( ‘’ ) );
    define( ‘COOKIE_DOMAIN’, ‘’ );
    define( ‘ADMIN_COOKIE_PATH’, ‘/’ );
    define( ‘COOKIEPATH’, ‘/’ );
    define( ‘SITECOOKIEPATH’, ‘/’ );
    define( ‘TEST_COOKIE’, ‘thing_test_cookie’ );
    define( ‘AUTH_COOKIE’, ‘thing_’ . COOKIEHASH );
    define( ‘USER_COOKIE’, ‘thing_user_’ . COOKIEHASH );
    define( ‘PASS_COOKIE’, ‘thing_pass_’ . COOKIEHASH );
    define( ‘SECURE_AUTH_COOKIE’, ‘thing_sec_’ . COOKIEHASH );
    define( ‘LOGGED_IN_COOKIE’, ‘thing_logged_in’ . COOKIEHASH );

  29. This was a life saver.

    A couple of things to note though.
    1.) Definitely need to remove the define(‘COOKIEDOMAIN’, ”); line seems to interfere with the Domain Mapping plugin, like others have mentioned.

    2.) If you’re still receiving the infinite loop on any domain mapped with Domain Mapping plugin, you need to clear your cookies in the browser. Once I cleared my cookies the looping went away.

    Thanks again, this saved a lot of headache and time trying to get this up and working.

  30. AWESOME!

    I got the following error: “The constant “COOKIE_DOMAIN” is defined (probably in wp-config.php). Please remove or comment out that define() line.”

    Commented that line out and everything was okay.

    You’re a star!

  31. Any chance of getting you interested in looking into this problem again?

    My multisite wordpress install works for years without problems. But since some WP update (can’t recall which one, but it was several months ago) I seem to be getting the login redirect problem on ONE PARTICULAR SITE ONLY. I can login to the main site, I can login to any subsite, except to one particular one. I have been able to avoid the problem, but the customer is requiring a change now and I can’t help him.

    I am not very good with my linux and apache know-how, I only know my way around html and css and php, basically.

  32. I solve inserting this in .htaccess:

    BEGIN WordPress

    RewriteEngine On
    RewriteBase /
    RewriteRule ^index.php$ – [L]

    uploaded files

    RewriteRule ^([_0-9a-zA-Z-]+/)?files/(.+) wp-includes/ms-files.php?file=$2 [L]

    add a trailing slash to /wp-admin

    RewriteRule ^([_0-9a-zA-Z-]+/)?wp-admin$ $1wp-admin/ [R=301,L]
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ – [L]
    RewriteRule ^([_0-9a-zA-Z-]+/)?(wp-(content|admin|includes).*) $2 [L]
    RewriteRule ^([_0-9a-zA-Z-]+/)?(.*.php)$ $2 [L]
    RewriteRule . index.php [L]

    END WordPress

  33. I have the same problem, however its only happening when we try to login into the admin portion externally. I added the 4 lines of code to my config.php file and the issue is still there. Any suggestions?

  34. Having the COOKIE_PATH set to empty will cause the shopping cart for WooCommerce to empty upon adding of products to the cart. Adding a “/” to COOKIE_PATH instead of having it empty works like a charm. Hope this helps anyone with WooCommerce empty shopping cart issues.

    1. 5 letters : M E R C I

      I wish Tom could append your tip as a comment in the post’s body to improve relevance in search results : Solving these two issues at same time is really hard to figure.

      Thanks again for your precious comment.

  35. Greetings Tom, great article. I have a Similiar Issue with a Redirect Loop on a SSL Domain. I’ve spent hours trying to locate issue. Changed Permalinks, checked htaccess file for redirect and nothing. Standard http works ok. Will adding your code also work for Non-Multi-sites? Thanks in Advance.

    1. Without diving further into the situation, it sounds like you have a residual rewrite rule somewhere in the system that’s allowing this.

      It isn’t bad, per se, but I totally understand the concern you have for it.

      Unfortunately, that’s about all I can offer right now. My best advice would be to find someone that you’re friends with online and who knows WordPress and have them take a look at it.

      All the best!

  36. Tom, I have a similar issue — but maybe a hair different:

    — 5 site multisite setup as subdirectories

    — when performing (and saving) an Edit, clicking to another Site from Admin to front-end gets stuck in the endless loop

    So, I added the four lines of code before Happy Blogging! in wp-config, and got: “The constant “COOKIE_DOMAIN” is defined (probably in wp-config.php). Please remove or comment out that define() line.”

    I removed that line, bringing it down to the 3 lines remaining, and things appear to be working again. No random load-loop yet, but I’ll keep you posted on how things go.

    Thanks for the knowledge!

    Steve C.


  37. some people may be confusing a “sub-domain” install (the substance of this post) and a “sub-folder” install of wordpress multisite. desperation and google don’t mix: the presence of keywords can make you look in all the wrong places. if you are getting the redirect loop with a “sub-folder” install, changing your htaccess file to the following may help:

    RewriteEngine On

    RewriteBase /

    RewriteRule ^index\.php$ – [L]

    uploaded files

    RewriteRule ^([_0-9a-zA-Z-]+/)?files/(.+) wp-includes/ms-files.php?file=$2 [L]

    add a trailing slash to /wp-admin

    RewriteRule ^([_0-9a-zA-Z-]+/)?wp-admin$ $1wp-admin/ [R=301,L]

    RewriteCond %{REQUEST_FILENAME} -f [OR]

    RewriteCond %{REQUEST_FILENAME} -d

    RewriteRule ^ – [L]

    RewriteRule ^([_0-9a-zA-Z-]+/)?(wp-(content|admin|includes).*) $2 [L]

    RewriteRule ^([_0-9a-zA-Z-]+/)?(.*\.php)$ $2 [L]

    RewriteRule . index.php [L]

    1. Hey Markus – thanks for providing a link to what you did in order to get this to work with ‘Theme My Login.’ Hopefully it’ll help someone else who comes along with the same problem!

  38. I have a site with about 1,800 users and 2,000 pages and randomly some users get stuck in a loop accessing a members only section. Any one have any experience with applying this fix to a plain WP setup? Guess it wouldn’t hurt to try it right?

  39. I’m having the same problem with correct .htaccess, and brand new WP install using subdirectorys, not subdomains.

    How can this bug have been around so long and not addressed by WordPress authors?


    1. Unfortunately, I’ve no answer for that question.

      My guess is that it’s one for which too many variables can contribute to it so it’s not something the core software can resolve.

      Just a guess, though.

  40. hello, i have similar problem. After changing htaccess to multisite code, after you click something on website, it change or rewrite htaccess code to original state. I have change to root access and made new htaccess and it works but i saw 4 line error with wp-includes/nav-menu.php

    This happen because hacker inject code in nav-menu.php wordpress core file. It rewrites htaccess and change to chmod 444

    Check your wp-includes/nav-menu.php around line 502

    When it contains htaccess and 444 something like that. You have to download original latest wordpress file, and change wp-includes/nav-menu.php with original file.

    thats it!! it tooks me 6 hours with this …

    1. hello, i have similar problem. After changing htaccess to multisite code, after you click something on website, it change or rewrite htaccess code to original state. I have change to root access and made new htaccess and it works but i saw 4 line error with wp-includes/nav-menu.php

      This happen because hacker inject code in nav-menu.php wordpress core file. It rewrites htaccess and change to chmod 444

      Check your wp-includes/nav-menu.php around line 502

      This is definitely an outlier case – not a normal situation since it has to do with more malicious users than problems with a web server or a permissions issue.

  41. For the NGINX issue in the server block this is very stable:

    if (!-e $request_filename) {

    rewrite /wp-admin$ $scheme://$host$uri/ permanent;

    rewrite ^(/[^/]+)?(/wp-.*) $2 last;

    rewrite ^(/[^/]+)?(/.*\.php) $2 last;


    This works with or without Tom’s alteration in the wp-config.php file. I’m leaving it in so far so good.



  42. Thanks for posting this information!

    We were experiencing the infinite redirect loop and attempted the fix you provided. At first we got an error regarding COOKIE_DOMAIN and commented out that define.

    No more redirect loop on front-end.

    However, now when we go to login page and attempt to access the dashboard we get an error that password field is blank no matter how certain you are that the password was entered correctly. Login works successfully again once you comment out the remaining 3 lines.

    Has anyone else experienced this? I didn’t see an exact match in the other comments for this post.

    1. Thanks for sharing this info, Jacob! Personally, I don’t have a fix, but I would recommend the following:

      . Make sure that you’ve disabled all caching until this is resolved

      . Double-check your htaccess file to make sure nothing in there is doing anything weird

      . Verify that your wp-config file doesn’t have any type of oddities in there beyond the standard boilerplate code

      . Disable any other plugins – temporarily – that may be mucking with this information

      I don’t have a hard fix for you, but these are things that I always try to narrow down before anything else. Sometimes it works, sometimes not.

      1. Thanks Tom,

        We disabled “Remote Login” and that stopped the looping. However, that caused SSL errors because links to the dashboard from the admin bar were pointing to vs and causing a mis-match. We do have it set to force dashboard to SSL but only one wildcard cert for the MU network.

        We also wrote a few lines to disable admin bar and eliminate that confusion.

        Disabling other plugins didn’t help much – the main issue was the Remote Login.

        Appreciate any advice you can offer. Thanks again!

        1. We disabled “Remote Login” and that stopped the looping. However, that caused SSL errors because links to the dashboard from the admin bar were pointing to vs and causing a mis-match. We do have it set to force dashboard to SSL but only one wildcard cert for the MU network.

          I’m not familiar with Remote Login so I’m not sure what it does in the context of WordPress. It seems odd that this would interfere with SSL on any level, but if it’s a multisite network that may be part of the problem.

          Multisite Networks are fine, mind you, but make sure that their home URL is pointing to the proper place, that the URL is setup properly in each of the sites to use https:// over http:// and that the database in the wp_options table doesn’t have any residual records for http, as well.

          There may be something else at place, but I’m really at a loss with not being familiar with what that plugin does.

          1. Remote Login is a feature of the WP MU Domain Mapping plugin which makes this all work accross multiple vanity domains as opposed to simply using subdomains on their own.

            Remote Login ensures that any request to /wp-login is redirected from to specifically to prevent SSL mismatches as we’re now seeing.

            If we turn this feature on we get redirect loops. If we turn it off we get forced to essentially log in twice since the login screen gets redirected to the subdomain url after the first attempt.

            1. Unfortunately, there’s not much more I can offer beyond this. Perhaps someone else in the comments will have something to add.

              I don’t work with multisite much so my knowledge is limited in this area.

  43. Great article, finally something on the topic.

    Your article seems to be all I can find specifically on this type of “exotic” set-up, multiple WP Multi-Site installs on same domain using sub-domains.

    I’m really just trying to verify I have this right in my head and expectations.

    Other’s I’ve asked don’t get multiple multi-site and assume I mean can I put it in a sub-domain and no mention of cookie problems so I know they aren’t understanding and send instructions how to set-up multi site in a sub domain, the issue is multiple, thanks for writing this.

    My primary site is in the root and active on the domain, a WP Multi Site network.

    Now I want to set up 10 new WP Multi Site installs, each in its own sub domain, wildcards too, so that I can have them use… so eventually 11 different unrelated WP multisite networks.

    So one root level WPMU network, and 10 independent sub domain level WPMU networks.

    I assume I won’t be forced to choose directory but can use “2 level” sub-domains in this multi-site set-up using sub-domains?

    Here are the basic steps I’ve inferred here and elsewhere:

    Create sub-domains and corresponding wildcards in CPanel, one for each multisite install/network.
    Upload and install regular WordPress in each sub-domain
    Add this to my wp-config.php in each sub-domain and in the root Multi Site

    define(‘ADMIN_COOKIE_PATH’, ‘/’);

    define(‘COOKIE_DOMAIN’, ”);

    define(‘COOKIEPATH’, ”);

    define(‘SITECOOKIEPATH’, ”);

    add a .htaccess file into each sub-domain

    enable each sub-domain Network, choose sub-domains and replace existing WP lines with new ones in .htaccess

    On main domain, a Multi Site installed at root level, change salts then salts on sub-domains

    .htaccess – not sure but a rule to allow sub-domains to pass through the root htaccess to sub-domain htaccess or do sub-domains not see the root htaccess?



    PS – for readers wondering why, the sub-domains are “demo” networks if all goes well so my main network site and 10 demo networks

      1. Hey Tom,

        I’ve been trying to figure out how to get this plugin redirect to work. I’m trying to direct users to Post (A) link, but they of course get redirected to Post (B). Once on Post (B), I direct people to click on the hyperlink that say’s “Got To…Post Click Here,” which should go back to original Post (A), but goes to Post (B) again because of the redirect setup. Here’s the site I’m trying to mirror, weird thing is that it mostly only does the trick with mobile, which is what I would want to.

        If you can help me out it be much appreciated.

        Best Regards,


        1. Hey Brent,

          Unfortunately, I’m not really familiar with the plugin you’re talking about so there’s not much I can offer right now.

          Other than looking the referring URL in the PHP $_SERVER array, I’m not sure what to suggestion without knowing more. Hope this helps!

  44. I would like to contribute another error causing the multisite redirect loop.

    In my case the problem was found after the plesk migration of a subscription with a multisite to a new server.

    It took me considerable time to find it’s real cause, after implementing all the suggestions as mentioned in this post and comments without success.

    It appeared to be that in table _blogs the path fields of the sites contained a double ‘//’ instead off a single ‘/’.

    In this scenario, function ‘get_site_by_path’ in wp-includes/ms-load.php could not match any site causing the infinitive redirect loop.

    Hope this might help you too, rgrds Cees

  45. Hello Tom, and everyone:

    This technique works rather well & I think it will work in just about any multisite setup to stop looping.

    The only variable will most likely be whether you have to place a forward “/” in one of the lines or not – or possibly remove or comment out one of the lines.

    Mine is set up as so

    define(‘MULTISITE’, true);

    define(‘SUBDOMAIN_INSTALL’, false);

    define(‘DOMAIN_CURRENT_SITE’, ‘’);

    define(‘PATH_CURRENT_SITE’, ‘/’);

    define(‘SITE_ID_CURRENT_SITE’, 1);

    define(‘BLOG_ID_CURRENT_SITE’, 1);

    define(‘ADMIN_COOKIE_PATH’, ‘/’);

    define(‘COOKIE_DOMAIN’, ”);

    define(‘COOKIEPATH’, ‘/’);

    define(‘SITECOOKIEPATH’, ‘/’);

    Works as I personally want it to – You just need to remember clear those cookies and browser cache initially and also it pays to keep an eye on which one of your usernames is trying to sign into what site! If you get a white page with “You dont have permission to access this on this site” message, then just hit the “back”tab to go back to where you were, log out and back again with your username and password again, that will get you back in.

    We use our small multisite setup to contain our site and a support portal for products, members and customers. plus a small site or two for holding tutorials..

    You helped a lot of people here Tom!

    1. Thanks for sharing this, Brian – I love having a paper trail of other configuration options in the comments so others who stumble across this may end up finding something for their specific need.

    2. Thanks for this snippet, Tom

      And thanks Brian for your contribution.

      I reckon Brian’s case works on GoDaddy and I had the same problem and tried various confiugrations until I stumbled on Tom’s post and Brian’s workaround.

      Specifically, this has to do with WordPress Multisite on a GoDaddy Managed (Ultimate) WordPress Installation with Sub-Directories. (No Wildcard DNS).

      The code worked on Google, Safari & Microsoft Edge AS IS and although I prefer Firefox for WP management due to javascript latency issues, Firefox does not handle it well.

      I also suggest checking .htaccess to see if the last Rewrite Rule contains the ‘/’.

      Here is my workaround if it helps anyone:

      define(‘WP_ALLOW_MULTISITE’, true);

      define(‘MULTISITE’, true);

      define(‘SUBDOMAIN_INSTALL’, false);

      define(‘DOMAIN_CURRENT_SITE’, ‘’);

      define(‘PATH_CURRENT_SITE’, ‘/’);

      define(‘SITE_ID_CURRENT_SITE’, 1);

      define(‘BLOG_ID_CURRENT_SITE’, 1);

      /The Following Code Snippet is added to fix redirect loop on WP login page on Firefox by clearing the cookies before setting them – refer to this article

      define(‘ADMIN_COOKIE_PATH’, ‘/’);

      define(‘COOKIE_DOMAIN’, ”);

      define(‘COOKIEPATH’, ‘/’);

      define(‘SITECOOKIEPATH’, ‘/’);

      /* That’s all, stop editing! Happy blogging. */

      If I had to guess, the ‘/’ plays a role depends on a lot of factors (ie plugins, php, and redirects already in place) but a fresh installation could also throw a loop into the mix.

      The NANA Unlimited multisite installation was established to demonstrate our services and products available to Freelancers, Entrepreunerus and Start Up Founders to hit their niche at full speed. Fast AND fat so to speak…

      Again, Thanks for this very useful post.

      Finest Regards


  46. THANK YOU!!!!!!!!!!!!

    No words to express my appreciation… I was ready to open a new hosting account, so that I could install MultiSite in the root folder and then use the Domain Mapping plugin.

    This was oh so much easier :)

  47. I’ve really been struggling with this on a multisite install. Adding just the line:


    does seem to solve the problem – I’m able to log in to admin now for a mapped subdomain site in my network.

    I have never been able to find the answer to this question however: Is there any bad side effect or security exposure of any type, by adding that define statement to wp-config.php?

    1. To my knowledge, there are no security issues. All this does is define the constant with an empty value (or a falsey value since we’re dealing with a dynamic language like PHP).

      By setting it to false, the cookie is available to all sites on the multisite domain. If that’s a security issue for something you’re running, then it made need to be something else.

      For example, if you just want to have the cookie sent to a specific domain, then you’d define the domain for the variable.

  48. This solution is STILL solved the “locked out of admin” problem now in mid 2016 with WordPress 4.5.3 so THANKYOU.

    I was so certain that I was making in a mis-step in the installation process… or that somehow my password was getting corrupted,.. or that something was wrong with my .htaccess or had somehow introduced a flaw in the wp-config.php or perhaps misunderstand the process of installing wordpress into a subfolder but making it appear as if at root level of the domain. Nada!.. Kudos to @Tom

  49. Tom, I’m seriously impressed that you are maintaining this after more than 3 years. It’s still relevant, as I found when I searched for “cant log in to WordPress subdomain unless main domain logged in”. That describes my situation, which I could not resolve despite checking DNS records on my host, and on CloudFlare. I was particularly confused, because login worked on other subdomains in my MultiSite network.

    I tried your solution, and got the message that other commenters have mentioned:

    The constant "COOKIE_DOMAIN" is defined (probably in wp-config.php). Please remove or comment out that define() line.

    So, I commented that out, and tried the suggestion to set it to the root. Then, I started reading through all your comments. When I saw references to “WordPress MU Domain Mapping” I thought that might be the problem. It was! But, not the usual plugin compatibility issues.

    It turned out that the idiot that installed the new site as a subdomain did everything perfectly. Except, set the actual mapping in Settings-Domains. Yes, that idiot was me! Just letting your readers know:

    If anyone has subdomain log in issues with WordPress MU Domain Mapping plugin, check the domain mapping is set correctly!

    1. Tom, I’m seriously impressed that you are maintaining this after more than 3 years.

      It’s really the commenters that continue to offer all of the input, so I can’t take all of the gratitude :).

      Just letting your readers know

      Case in point, right? So thanks for sharing your configuration!

      1. thx stu

        Company Google Voice: (513) 463-7225 (voice/sms) Personal Google Voice: 513 291-3528 (voice/sms)

        The contents of this communication, including any attachment(s), are confidential and may be privileged. If you are not the intended recipient (or are not receiving this communication on behalf of the intended recipient), please notify the sender immediately.

  50. It is 2017 and this was written in 2013. I am having this problem with a multisite instalation. On the example you offered a solution for a SECOND domain meaning there is the main domain and ONE other domain mapped. How about the situation where I have about 7 domains mapped in my multisite install??

    The way I get around it is by not creating user names and never loging into multise via one of the mapped domains. I ALWAYS log in as Super Admin and if I need to modify a mapped domain site I disable the mapped domain, do the changes and then enable mapping for that domain again. I would like to be able to loging with all of my domains mapped.

    In this case would I need one instance of this:

    4 NAME = wordpress_d676ec21cf050e966685794aa715694f

    5 PATH = /sitename/

    for each one of the 7 (and growing) domians mapped?

    Thanks for this posting!

    1. Unfortunately, I don’t have an answer for you :(.

      Since 2013, I’ve really moved away from multisite installations and I know there have been some changes in how they work with the updates over the last four years.

      I wish I had a better answer for you, but that’s what I’ve got.

Leave a Reply