If your WordPress login form redirects you back to itself in an endless loop right after entering your password and two-factor code — and this started right around a Cloudflare Turnstile change or update — the cause is a known incompatibility between Cloudflare Turnstile's challenge widget and Wordfence's built-in two-factor authentication flow on the login screen. The two features can end up fighting over the same login submission, so WordPress never completes the authentication step and just sends you back to the login page. If you're currently locked out of wp-admin entirely, skip straight to the recovery step below; if you can still reach the site (just not log in), go to the actual fix afterward.

Symptoms

  • After entering your password and 2FA code, the page reloads the login form again instead of taking you to wp-admin — with no visible error message.
  • The loop is new, and started shortly after Cloudflare pushed a Turnstile-related change, or after you enabled Turnstile as your CAPTCHA/bot-check method.
  • Logging in works fine in one browser or device but loops in another, or it loops only when Turnstile's widget is visibly present on the login page.
  • Disabling two-factor authentication temporarily (if you can reach your account settings another way) stops the loop.

Likely causes, in order of how often they actually happen

  1. Wordfence's 2FA form submission conflicts with the Turnstile widget's token verification, where Turnstile's client-side challenge either re-renders or expires at the exact moment Wordfence is trying to validate the one-time code, so the combined form never successfully submits both pieces together.
  2. An outdated Wordfence version paired with a newer Turnstile widget mode — Cloudflare has changed Turnstile's default widget behavior (e.g., managed vs. non-interactive mode) over time, and older Wordfence releases weren't tested against the newer mode.
  3. Turnstile is set to a mode that reloads or re-issues its token on every page interaction, which interferes with any login form (not just Wordfence's) that expects the page state to stay consistent between password entry and 2FA code entry.
  4. Browser-side caching or a security/privacy extension is blocking Turnstile's script from loading correctly, making the widget appear to fail silently and the form resubmit without ever getting a valid token.

If you're completely locked out: regain access first

If you can't get past the loop at all — not through any browser, not from any device — you need file-level access to your site (via FTP/SFTP, or your host's File Manager) to disable Wordfence without going through wp-admin:

  1. Connect to your site's files and navigate to wp-content/plugins/.
  2. Find the folder named wordfence.
  3. Rename it to something like wordfence-disabled. WordPress detects the plugin's main file is missing and automatically deactivates Wordfence — this does not delete any Wordfence data or settings, it just turns the plugin off.
  4. Log in to wp-admin normally; without Wordfence's 2FA layer active, Cloudflare Turnstile alone (if it's on the login form at all) shouldn't cause a loop, since the conflict is specifically between the two.
  5. Once logged in, rename the folder back to wordfence from your file manager, or reactivate it from Plugins in wp-admin — Wordfence will reappear with your previous settings intact.

Fix it: lowest-risk steps first

Step 1 — Update both plugins/settings to current versions

This is the fix that resolves the issue most often, because the conflict has been addressed on both sides at different points as each project patched around the other's behavior. In wp-admin, go to Plugins → Installed Plugins and update Wordfence to the latest version if an update is available. Separately, in your Cloudflare dashboard, check whether your Turnstile widget configuration needs updating — Cloudflare periodically changes default settings for existing Turnstile widgets, so revisiting the widget's configuration screen (rather than assuming it's untouched) matters here.

Step 2 — Check Wordfence's login security settings for the specific conflict

In wp-admin (or via the file-rename method above if you're still locked out), go to Wordfence → Login Security. Review the Enable two-factor authentication settings and confirm whether Wordfence itself has any known CAPTCHA/Turnstile integration setting turned on or off — if a "reCAPTCHA" or third-party CAPTCHA option under Wordfence's login form settings is enabled alongside Cloudflare's own Turnstile challenge on the same page, you have two separate challenge systems competing for the same form. Disable Wordfence's own CAPTCHA integration if Cloudflare Turnstile is already handling that job at the edge — you don't need both.

Step 3 — Change Turnstile's widget mode for the login page

In your Cloudflare dashboard, review the Turnstile widget tied to your site (Turnstile is managed under its own section in the dashboard, separate from the general WAF). If the widget is set to a fully "managed" or automatically-refreshing mode, try switching it to the "non-interactive" mode where supported, which reduces how often the widget re-issues its verification token during a multi-step form like password-plus-2FA. Save, clear your browser cache, and retest the full login flow end to end.

Step 4 — Temporarily disable Turnstile on the login path only (last resort)

If updates and settings changes don't resolve it and you need reliable access immediately, remove Turnstile's challenge specifically from /wp-login.php (via the same kind of WAF custom rule "Skip" approach used for Managed Challenge, scoped to this path) while you continue troubleshooting the underlying plugin versions. Re-enable it once you've confirmed an update on either the Wordfence or Turnstile side has resolved the conflict — don't leave the login page unprotected at the edge indefinitely.

Verify the fix

  1. Log out completely and log back in from a fresh private/incognito window, entering both your password and 2FA code.
  2. Confirm you land on the wp-admin dashboard on the first attempt, with no redirect back to the login form.
  3. Test from a second browser or device to confirm the fix isn't specific to one machine's cache or cookies.
  4. Check Wordfence → Login Security → Two-Factor Authentication to confirm 2FA is still actually active for your account (rather than accidentally left disabled from earlier troubleshooting).

If you need to roll back

If updating Wordfence or changing the Turnstile widget mode causes new problems, restore your site from the backup you took before making changes, or simply revert the specific setting you changed last (Turnstile widget mode, or Wordfence's CAPTCHA integration toggle) rather than the whole site — this conflict is narrow enough that a full restore is rarely necessary once you've isolated which side caused it.

Related fixes

FAQ

Does renaming the Wordfence folder delete my firewall rules or settings?

No. Renaming the plugin folder only deactivates the plugin in WordPress's eyes; all of Wordfence's stored settings, scan history, and firewall rules remain in the database and reappear once you rename the folder back or reactivate the plugin.

Should I just remove two-factor authentication instead of fixing this?

That removes a meaningful layer of account security and isn't necessary — this is a known, fixable compatibility issue between two specific features, not a fundamental flaw in either 2FA or Turnstile. Work through the update and settings steps above before considering permanently disabling 2FA.

Can I use Cloudflare Turnstile and Wordfence 2FA together safely once this is fixed?

Yes. Once both are on current versions and you're not running two separate CAPTCHA/challenge systems stacked on the same login form (Step 2), the combination works normally for most sites — this is a compatibility bug tied to specific version/mode combinations, not a permanent conflict between the two products.