WordPress "Cookies are blocked due to unexpected output" Login Fix

You enter the right username and password on wp-login.php and instead of the dashboard you get an error: "Error: Cookies are blocked due to unexpected output." or "Error: Cookies are blocked or not supported by your browser. You must enable cookies to use WordPress." The two messages look alike but usually have different causes, and the first one is a server problem, not a browser setting.

Which message do you have?

"Cookies are blocked due to unexpected output" means WordPress tried to send the login cookie header, but PHP had already started sending the page. Once output begins, headers are locked and the cookie never arrives. Something printed text, a space or a byte order mark before WordPress was done.

"Cookies are blocked or not supported by your browser" means WordPress set a test cookie and could not see it come back. That points to the browser, a cookie domain mismatch, caching or a proxy.

Fix for "unexpected output"

1. Look for stray output in config and theme files

Check wp-config.php first. It must start with <?php at the very first byte and should not have anything, even a blank line, after a closing ?>. Best practice is to omit the closing tag in pure PHP files. Do the same check on the active theme's functions.php and any recently edited plugin or must-use plugin.

Find files that start with a UTF-8 byte order mark (BOM), which editors add invisibly:

grep -rl $'\xEF\xBB\xBF' --include=*.php wp-config.php wp-content/themes wp-content/plugins wp-content/mu-plugins

Re-save those files as UTF-8 without BOM. Then look for leading whitespace:

grep -rlPz '\A\s+<\?php' --include=*.php wp-config.php wp-content/themes wp-content/mu-plugins

2. Read the warning that names the culprit

If PHP warnings are visible on the login page, they include the origin:

Warning: Cannot modify header information - headers already sent by (output started at /var/www/html/wp-content/themes/mytheme/functions.php:1)

The path and line is your answer. The general cause is explained in PHP headers already sent and its WordPress version, cannot modify header information. If nothing displays, log errors with WP_DEBUG_LOG and read wp-content/debug.log.

3. Disable plugins and switch theme

Rename wp-content/plugins to plugins.off, and try to log in. If it works, restore plugins one at a time. Repeat with the theme by renaming the active theme's folder so WordPress falls back to a default one. Method: plugin conflict troubleshooting.

Fix for "cookies are blocked or not supported"

1. Clear cookies and cache for the site, and try a private window. Browser extensions that block cookies or scripts can interfere.
2. Check the browser's cookie policy. Blocking all cookies for the site, or blocking third-party cookies when the login happens inside an iframe, stops the test cookie.
3. Check the system clock. A badly wrong date makes cookies expire immediately.
4. Check the site URLs. Settings, General (or WP_HOME and WP_SITEURL) must use one hostname. If you log in at www.example.com while the site URL is example.com, the cookie is set for another domain.
5. Check COOKIE_DOMAIN. In wp-config.php, a hard-coded value that does not match the real host breaks logins. Remove it unless you need it.

// Remove or fix this if present and wrong
define( 'COOKIE_DOMAIN', 'example.com' );

1. Check HTTP versus HTTPS. If the site forces SSL admin (FORCE_SSL_ADMIN) while a proxy talks plain HTTP to the origin, WordPress may not see a secure request. Make sure it trusts X-Forwarded-Proto; see WordPress SSL and HTTPS migration.
2. Look for caching of wp-login.php. The login page must not be cached. Check with the HTTP Header Checker that it sends no-cache style headers and a Set-Cookie header. A cached response has no fresh test cookie.

See what the server sends

Fetch the login page headers:

curl -sI https://example.com/wp-login.php | grep -i -E "^(HTTP|set-cookie|cache-control|location)"

You should see Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check. If it is absent, something strips or blocks it, such as a proxy, cache or output problem. The Cookie Checker displays cookie flags (Secure, HttpOnly, SameSite, domain), and cookie flags explained covers what each does. A Secure cookie set over an HTTP connection will never be returned. If login loops back to itself instead, trace the hops with the Redirect Checker.

How to verify

Log in from a private window, confirm you reach /wp-admin/, then close and reopen the browser and check the session persists with "Remember me". Check for new entries in debug.log and that wp-login.php still returns 200 in the HTTP Status Checker.

Next steps

• Read WordPress too many redirects fix if login bounces.
• See Sorry, you are not allowed to access this page if you log in but lack rights.
• Harden the login with the security hardening checklist.

FAQ

Do I need to enable cookies in my browser?

Only for the second message. For "unexpected output" your browser is fine; the server printed something too early.

Why did it start after I edited a file?

Editors can add a BOM or trailing space. The error appears the moment a file begins output.

Is a closing PHP tag a problem?

Not by itself, but any whitespace after it is sent to the browser. Omitting it in PHP-only files avoids the trap.

Can a security plugin cause this?

Yes. Plugins that change login URLs, cookies or sessions can interfere. Disable them to test.

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.