WPFIX STACK — home
Cloudflare & SSL

WordPress Login Loop After a Cloudflare Turnstile Update? Fix Wordfence 2FA Conflicts

Stuck in an infinite WordPress login redirect after a Cloudflare Turnstile update? Here's the Wordfence two-factor conflict causing it and how to fix or unlock it.

By Published Updated 6 min read

Close-up of two brass padlocks securing a vibrant graffiti-painted door, symbolizing security.
Photo by Daniel Trylski on Pexels

If your WordPress login form redirects you back to itself in an endless loop right after entering your password and two-factor code — and this started around a Turnstile update — the likely cause is the plugin that adds Turnstile to your login form clashing with Wordfence's two-factor step. Turnstile tokens are single-use and expire after 300 seconds (opens in a new tab), so a login that happens in two steps (password, then 2FA code) has to handle them carefully. The popular Simple Cloudflare Turnstile plugin shipped exactly this bug: its changelog for version 1.42.0 (opens in a new tab) fixes an issue, present since 1.41, where the login widget could reset while a Wordfence 2FA prompt was open, causing the login to fail. If you're currently locked out of wp-admin entirely, skip straight to the recovery step below; if you can still reach the site (just not log in), go to the fix afterward.

Symptoms

  • After entering your password and 2FA code, the page reloads the login form again instead of taking you to wp-admin — with no visible error message.
  • The loop is new, and started shortly after you updated your Turnstile plugin or enabled Turnstile on the login form.
  • Logging in works fine in one browser or device but loops in another, or it loops only when Turnstile's widget is visibly present on the login page.
  • Disabling two-factor authentication temporarily (if you can reach your account settings another way) stops the loop.

Likely causes, in order of how often they actually happen

  1. A Turnstile plugin version with a known 2FA bug. Simple Cloudflare Turnstile 1.41.x could reset its login widget while a two-factor prompt was open (fixed in 1.42.0 (opens in a new tab)); Wordfence 9 passkey logins were rejected with a "missing challenge" error until 1.43.0.
  2. A token that expired or was already used. Turnstile tokens are valid for 300 seconds and can only be validated once (opens in a new tab); if the 2FA step re-submits the form with the same token, or you take more than five minutes to enter the code, the second check fails.
  3. Browser-side caching or a security/privacy extension is blocking Turnstile's script from loading correctly, making the widget appear to fail silently and the form resubmit without ever getting a valid token.

If you're completely locked out: regain access first

If you can't get past the loop at all — not through any browser, not from any device — you need file-level access to your site (via FTP/SFTP, or your host's File Manager) to disable Wordfence without going through wp-admin:

  1. Connect to your site's files and navigate to wp-content/plugins/.
  2. Find the folder named wordfence.
  3. Rename it to something like wordfence-disabled. WordPress detects the plugin's main file is missing and automatically deactivates Wordfence — this does not delete any Wordfence data or settings, it just turns the plugin off.
  4. Log in to wp-admin normally; without Wordfence's two-factor step, the Turnstile check has only one submission to verify. (If you'd rather keep Wordfence running, rename the Turnstile plugin's folder instead — the conflict needs both.)
  5. Once logged in, rename the folder back to wordfence from your file manager, or reactivate it from Plugins in wp-admin — Wordfence will reappear with your previous settings intact.

Fix it: lowest-risk steps first

Step 1 — Update both plugins/settings to current versions

In wp-admin, go to Plugins → Installed Plugins and update the plugin that adds Turnstile to your login form — for Simple Cloudflare Turnstile, at least 1.42.0 for the Wordfence 2FA fix, or 1.43.0 if you use Wordfence 9 passkeys — and update Wordfence too. This is the fix most likely to work, because the bug lives in specific plugin versions.

Step 2 — Check Wordfence's login security settings for the specific conflict

In wp-admin (or via the file-rename method above if you're still locked out), go to Wordfence → Login Security. Wordfence's login protection has its own reCAPTCHA option (opens in a new tab) next to 2FA; if it's enabled alongside a Turnstile plugin, you have two separate challenge systems on the same form. Disable one of them — you don't need both.

Step 3 — Check the Turnstile plugin's settings for the login form

In the Turnstile plugin's settings, check which forms it protects and whether it offers an IP whitelist — Simple Cloudflare Turnstile can skip the check for whitelisted IPs, a clean way to exempt your own static admin IP while testing. The widget mode set in Cloudflare's Turnstile dashboard (Managed, Non-interactive or Invisible (opens in a new tab)) changes how the challenge looks, not how tokens are validated, so changing it alone is unlikely to fix a 2FA loop.

Step 4 — Temporarily disable Turnstile on the login path only (last resort)

If updates and settings changes don't resolve it and you need reliable access immediately, turn off Turnstile for the WordPress login form in the plugin's settings — a Cloudflare WAF rule can't do this, because the widget is added by the plugin, not by Cloudflare's edge. Keep Wordfence's own login protection on in the meantime, and re-enable Turnstile once an update fixes the conflict; don't leave the login form without any bot check indefinitely.

Verify the fix

  1. Log out completely and log back in from a fresh private/incognito window, entering both your password and 2FA code.
  2. Confirm you land on the wp-admin dashboard on the first attempt, with no redirect back to the login form.
  3. Test from a second browser or device to confirm the fix isn't specific to one machine's cache or cookies.
  4. Check Wordfence → Login Security → Two-Factor Authentication to confirm 2FA is still actually active for your account (rather than accidentally left disabled from earlier troubleshooting).

If you need to roll back

If updating a plugin or changing a setting causes new problems, revert that one change (roll the plugin back or restore the setting) rather than restoring the whole site — this conflict is narrow enough that a full restore is rarely necessary. Restore from the backup you took before starting only if something else broke.

FAQ

Does renaming the Wordfence folder delete my firewall rules or settings?

No. Renaming the plugin folder only deactivates the plugin in WordPress's eyes; all of Wordfence's stored settings, scan history, and firewall rules remain in the database and reappear once you rename the folder back or reactivate the plugin.

Should I just remove two-factor authentication instead of fixing this?

That removes a meaningful layer of account security and isn't necessary — this is a known, fixable compatibility issue between two specific features, not a fundamental flaw in either 2FA or Turnstile. Work through the update and settings steps above before considering permanently disabling 2FA.

Can I use Cloudflare Turnstile and Wordfence 2FA together safely once this is fixed?

Yes. With the Turnstile plugin on a version that handles two-step logins, and only one CAPTCHA on the login form (Step 2), the combination works normally — this was a bug in specific plugin versions, not a permanent conflict between the two products.

Stefan Nistor

Founder, WP Fix Stack

Stefan runs WP Fix Stack. Every guide checks its commands, menu paths and limits against the official documentation of WordPress, PHP, the hosting panel, Cloudflare or the plugin involved, and links those sources so you can verify them. Fixes are ordered from the least risky step, each guide ends with a way to confirm the fix and roll it back, and guides are corrected, with a new Updated date, when the documentation or the software changes.

Every guide explains the symptom, likely causes, the safest order of checks and how to confirm the fix. How we check our guides.

On this page