title: Wordpress wp-admin redirect loop, yet again
body: <p>I realize this question has been asked many times before, but I think my problem is unique (but don't we all think that?... /philosophy)</p>
  
  <p>My site is getting a redirect loop when trying to login to wp-admin. If I use wp-admin/index.php, it works and allows me to get to the admin area (the link changes to <a href="http://example/wp-login.php?redirect_to=http%3A%2F%2Fexample%2Fwp-admin%2Findex.php&amp;reauth=1" rel="noreferrer">http://example/wp-login.php?redirect_to=http%3A%2F%2Fexample%2Fwp-admin%2Findex.php&amp;reauth=1</a>). The code is identical locally and on the production server.</p>
  
  <p>I'm running apache2.4.7, PHP 5.3.29, Ubuntu 14.04. This started to occur after upgrading to WP4.2.1.</p>
  
  <p>I've checked permissions and ownership as suggested <a href="https://stackoverflow.com/questions/14532520/redirect-loop-on-wp-admin-or-wp-login-php">here</a>, I've checked .htaccess and apache2.conf (see below) as suggested <a href="https://wordpress.org/support/topic/redirect-loop-problem" rel="noreferrer">here</a>, I've checked wp_options, siteurl/home settings as suggested <a href="https://wordpress.org/support/topic/wp-multisite-redirect-loop-after-migrating-to-real-server" rel="noreferrer">here</a>, and I've seen the same question <a href="https://stackoverflow.com/questions/26646683/wordpress-wp-admin-infinite-redirect-loop">here</a> with requests for more details but no fix.</p>
  
  <p>The site is working locally, and the admin section works as well.
  The production site works fine, but when I try wp-admin, the production server gives a redirect loop. The problem started after upgrading to WP 4.2.1.
  The site has the following plugins enabled and up-to-date: Akismet, All-in-One SEO pack, Antispam Bee, AntiVirus, Google Analytics by Yoast, Google Maps for WordPress, jellyfish Counter Widget, MCE Table Buttons, and WP Responsive Menu.</p>
  
  <p>My process is to update locally, test, then push to our deployment server. I deploy from there to the production server, so the only code that gets onto production is from my local machine, and it’s a straight shot, no modifications or conversions along the way.</p>
  
  <p>Why am I getting a redirect error?
  The problem MUST be in the settings, database, or configuration… it CAN’T be in the code since the code works on my machine locally. Right???</p>
  
  <p>Ok, my troubleshooting steps (after each step I restarted the apache2 engine):</p>
  
  <p>First test: disable all plugins.</p>
  
  <p>Tested and received the same redirect loop error, so I re-enabled the plugins.</p>
  
  <p>Checked wp_options siteurl and home to verify they were set correctly</p>
  
  <pre><code>mysql&gt; select * from wp_options where option_id = '37' or option_id='1';
  +-----------+-------------+--------------------------------------------------+----------+
  | option_id | option_name | option_value | autoload |
  +-----------+-------------+--------------------------------------------------+----------+
  | 1 | siteurl | http://example.com/site | yes |
  | 37 | home | http://example.com/site | yes |
  +-----------+-------------+--------------------------------------------------+----------+
  2 rows in set (0.00 sec)
  </code></pre>
  
  <p>Also checked wp-config.php to make sure the settings were correct (I’m not sure which overrides the other):</p>
  
  <pre><code>define('WP_SITEURL', 'http://'.$_SERVER['HTTP_HOST']);
  define('WP_HOME', 'http://'.$_SERVER['HTTP_HOST']);
  </code></pre>
  
  <p>Turned off mod_rewrite in apache2.conf.</p>
  
  <pre><code>sudo a2dismod rewrite
  </code></pre>
  
  <p>Same results, so re-enabled:</p>
  
  <pre><code>sudo a2enmod rewrite
  </code></pre>
  
  <p>My .htaccess file at the root of my site is the default:</p>
  
  <pre><code># BEGIN WordPress
  &lt;IfModule mod_rewrite.c&gt;
  RewriteEngine On
  RewriteBase /
  RewriteRule ^index\.php$ - [L]
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule . /index.php [L]
  &lt;/IfModule&gt;
  # END WordPress
  </code></pre>
  
  <p>So I commented out the rewrite engine directives and re-tested.</p>
  
  <pre><code># BEGIN WordPress
  &lt;IfModule mod_rewrite.c&gt;
  #RewriteEngine On
  #RewriteBase /
  #RewriteRule ^index\.php$ - [L]
  #RewriteCond %{REQUEST_FILENAME} !-f
  #RewriteCond %{REQUEST_FILENAME} !-d
  #RewriteRule . /index.php [L]
  &lt;/IfModule&gt;
  # END WordPress
  </code></pre>
  
  <p>No change. Reverted back to normal. There are no other .htaccess files in the code except in wp-content/plugins/akismet/.htaccess.</p>
  
  <p>Here is my apache2.conf file:</p>
  
  <pre><code># This is the main Apache server configuration file. It contains the
  # configuration directives that give the server its instructions.
  # See http://httpd.apache.org/docs/2.4/ for detailed information about
  # the directives and /usr/share/doc/apache2/README.Debian about Debian specific
  # hints.
  #
  #
  # Summary of how the Apache 2 configuration works in Debian:
  # The Apache 2 web server configuration in Debian is quite different to
  # upstream's suggested way to configure the web server. This is because Debian's
  # default Apache2 installation attempts to make adding and removing modules,
  # virtual hosts, and extra configuration directives as flexible as possible, in
  # order to make automating the changes and administering the server as easy as
  # possible.
  
  # It is split into several files forming the configuration hierarchy outlined
  # below, all located in the /etc/apache2/ directory:
  #
  # /etc/apache2/
  # |-- apache2.conf
  # | `-- ports.conf
  # |-- mods-enabled
  # | |-- *.load
  # | `-- *.conf
  # |-- conf-enabled
  # | `-- *.conf
  # `-- sites-enabled
  # `-- *.conf
  #
  #
  # * apache2.conf is the main configuration file (this file). It puts the pieces
  # together by including all remaining configuration files when starting up the
  # web server.
  #
  # * ports.conf is always included from the main configuration file. It is
  # supposed to determine listening ports for incoming connections which can be
  # customized anytime.
  #
  # * Configuration files in the mods-enabled/, conf-enabled/ and sites-enabled/
  # directories contain particular configuration snippets which manage modules,
  # global configuration fragments, or virtual host configurations,
  # respectively.
  #
  # They are activated by symlinking available configuration files from their
  # respective *-available/ counterparts. These should be managed by using our
  # helpers a2enmod/a2dismod, a2ensite/a2dissite and a2enconf/a2disconf. See
  # their respective man pages for detailed information.
  #
  # * The binary is called apache2. Due to the use of environment variables, in
  # the default configuration, apache2 needs to be started/stopped with
  # /etc/init.d/apache2 or apache2ctl. Calling /usr/bin/apache2 directly will not
  # work with the default configuration.
  
  
  # Global configuration
  #
  
  #
  # ServerRoot: The top of the directory tree under which the server's
  # configuration, error, and log files are kept.
  #
  # NOTE! If you intend to place this on an NFS (or otherwise network)
  # mounted filesystem then please read the Mutex documentation (available
  # at &lt;URL:http://httpd.apache.org/docs/2.4/mod/core.html#mutex&gt;);
  # you will save yourself a lot of trouble.
  #
  # Do NOT add a slash at the end of the directory path.
  #
  ServerRoot "/etc/apache2"
  
  #
  # The accept serialization lock file MUST BE STORED ON A LOCAL DISK.
  #
  Mutex file:${APACHE_LOCK_DIR} default
  
  #
  # PidFile: The file in which the server should record its process
  # identification number when it starts.
  # This needs to be set in /etc/apache2/envvars
  #
  PidFile ${APACHE_PID_FILE}
  
  #
  # Timeout: The number of seconds before receives and sends time out.
  #
  Timeout 300
  
  #
  # KeepAlive: Whether or not to allow persistent connections (more than
  # one request per connection). Set to "Off" to deactivate.
  #
  KeepAlive On
  
  #
  # MaxKeepAliveRequests: The maximum number of requests to allow
  # during a persistent connection. Set to 0 to allow an unlimited amount.
  # We recommend you leave this number high, for maximum performance.
  #
  MaxKeepAliveRequests 100
  
  #
  # KeepAliveTimeout: Number of seconds to wait for the next request from the
  # same client on the same connection.
  #
  KeepAliveTimeout 5
  
  
  # These need to be set in /etc/apache2/envvars
  User ${APACHE_RUN_USER}
  Group ${APACHE_RUN_GROUP}
  
  #
  # HostnameLookups: Log the names of clients or just their IP addresses
  # e.g., www.apache.org (on) or 204.62.129.132 (off).
  # The default is off because it'd be overall better for the net if people
  # had to knowingly turn this feature on, since enabling it means that
  # each client request will result in AT LEAST one lookup request to the
  # nameserver.
  #
  HostnameLookups Off
  
  # ErrorLog: The location of the error log file.
  # If you do not specify an ErrorLog directive within a &lt;VirtualHost&gt;
  # container, error messages relating to that virtual host will be
  # logged here. If you *do* define an error logfile for a &lt;VirtualHost&gt;
  # container, that host's errors will be logged there and not here.
  #
  ErrorLog ${APACHE_LOG_DIR}/error.log
  
  #
  # LogLevel: Control the severity of messages logged to the error_log.
  # Available values: trace8, ..., trace1, debug, info, notice, warn,
  # error, crit, alert, emerg.
  # It is also possible to configure the log level for particular modules, e.g.
  # "LogLevel info ssl:warn"
  #
  LogLevel warn
  
  # Include module configuration:
  IncludeOptional mods-enabled/*.load
  IncludeOptional mods-enabled/*.conf
  
  # Include list of ports to listen on
  Include ports.conf
  
  
  # Sets the default security model of the Apache2 HTTPD server. It does
  # not allow access to the root filesystem outside of /usr/share and /var/www.
  # The former is used by web applications packaged in Debian,
  # the latter may be used for local directories served by the web server. If
  # your system is serving content from a sub-directory in /srv you must allow
  # access here, or in any related virtual host.
  &lt;Directory /&gt;
  Options FollowSymLinks
  AllowOverride None
  Require all denied
  &lt;/Directory&gt;
  
  &lt;Directory /usr/share&gt;
  AllowOverride None
  Require all granted
  &lt;/Directory&gt;
  
  &lt;Directory /var/www/&gt;
  Options Indexes FollowSymLinks
  AllowOverride None
  Require all granted
  &lt;/Directory&gt;
  
  #&lt;Directory /srv/&gt;
  # Options Indexes FollowSymLinks
  # AllowOverride None
  # Require all granted
  #&lt;/Directory&gt;
  
  
  
  
  # AccessFileName: The name of the file to look for in each directory
  # for additional configuration directives. See also the AllowOverride
  # directive.
  #
  AccessFileName .htaccess
  
  #
  # The following lines prevent .htaccess and .htpasswd files from being
  # viewed by Web clients.
  #
  &lt;FilesMatch "^\.ht"&gt;
  Require all denied
  &lt;/FilesMatch&gt;
  
  
  #
  # The following directives define some format nicknames for use with
  # a CustomLog directive.
  #
  # These deviate from the Common Log Format definitions in that they use %O
  # (the actual bytes sent including headers) instead of %b (the size of the
  # requested file), because the latter makes it impossible to detect partial
  # requests.
  #
  # Note that the use of %{X-Forwarded-For}i instead of %h is not recommended.
  # Use mod_remoteip instead.
  #
  LogFormat "%v:%p %h %l %u %t \"%r\" %&gt;s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
  LogFormat "%h %l %u %t \"%r\" %&gt;s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
  LogFormat "%h %l %u %t \"%r\" %&gt;s %O" common
  LogFormat "%{Referer}i -&gt; %U" referer
  LogFormat "%{User-agent}i" agent
  
  # Include of directories ignores editors' and dpkg's backup files,
  # see README.Debian for details.
  
  # Include generic snippets of statements
  IncludeOptional conf-enabled/*.conf
  
  # Include the virtual host configurations:
  IncludeOptional sites-enabled/*.conf
  
  # vim: syntax=apache ts=4 sw=4 sts=4 sr noet
  
  # added the following to enable fastcgi
  #&lt;IfModule mod_fastcgi.c&gt;
  # AddHandler php5-fcgi .php
  # Action php5-fcgi /php5-fcgi
  # Alias /php5-fcgi /usr/lib/cgi-bin/php5-fcgi
  # FastCgiExternalServer /usr/lib/cgi-bin/php5-fcgi -host 127.0.0.1:9000 -pass-header Authorization
  # &lt;Directory /usr/lib/cgi-bin&gt;
  # Require all granted
  # &lt;/Directory&gt;
  #&lt;/IfModule&gt;
  </code></pre>
  
  <p>And here is my sites-available conf file:</p>
  
  <pre><code>&lt;VirtualHost *:80&gt;
  # The ServerName directive sets the request scheme, hostname and port that
  # the server uses to identify itself. This is used when creating
  # redirection URLs. In the context of virtual hosts, the ServerName
  # specifies what hostname must appear in the request's Host: header to
  # match this virtual host. For the default virtual host (this file) this
  # value is not decisive as it is used as a last resort host regardless.
  # However, you must set it for any further virtual host explicitly.
  ServerAlias www.example.com
  ServerAlias another.example.com
  ServerName example.com
  
  ServerAdmin support@example.com
  DocumentRoot /var/www/example.com/site
  DirectoryIndex /index.php /index.html
  
  # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
  # error, crit, alert, emerg.
  # It is also possible to configure the loglevel for particular
  # modules, e.g.
  LogLevel debug
  
  ErrorLog ${APACHE_LOG_DIR}/error.log
  CustomLog ${APACHE_LOG_DIR}/access.log combined
  
  # SuexecUserGroup triadmin triadmin
  
  &lt;Directory /var/www/example.com/site&gt;
  AllowOverride All
  Options +ExecCGI +FollowSymlinks
  Order allow,deny
  Allow from all
  &lt;/Directory&gt;
  # &lt;IfModule mod_rewrite.c&gt;
  # RewriteEngine On
  # RewriteOptions inherit
  #
  # RewriteCond %{HTTP_HOST} ^example\.com
  # RewriteRule ^(.*)$ http://www.example.com%{REQUEST_URI} [R=301,L]
  # &lt;/IfModule&gt;
  # For most configuration files from conf-available/, which are
  # enabled or disabled at a global level, it is possible to
  # include a line for only one particular virtual host. For example the
  # following line enables the CGI configuration for this host only
  # after it has been globally disabled with "a2disconf".
  #Include conf-available/serve-cgi-bin.conf
  &lt;/VirtualHost&gt;
  
  &lt;IfModule mod_ssl.c&gt;
  &lt;VirtualHost *:443&gt;
  #&lt;VirtualHost 45.55.176.172:443&gt;
  #SuexecUserGroup triadmin triadmin
  ServerName www.example.com
  ServerAlias example.com
  ServerAdmin support@example.com
  DocumentRoot /var/www/example.com/site
  &lt;Directory /var/www/example.com/site&gt;
  AllowOverride All
  Options +ExecCGI +FollowSymlinks
  Order allow,deny
  Allow from all
  &lt;/Directory&gt;
  &lt;IfModule mod_rewrite.c&gt;
  RewriteEngine On
  RewriteOptions inherit
  
  RewriteCond %{HTTP_HOST} ^example\.com
  RewriteRule ^(.*)$ https://www.example.com%{REQUEST_URI} [R=301,L]
  &lt;/IfModule&gt;
  
  # SSL Engine Switch:
  # Enable/Disable SSL for this virtual host.
  # SSLEngine on
  # SSLCertificateFile /etc/ssl/apache/example/your_cert_name_here.crt
  # SSLCertificateKeyFile /etc/ssl/apache/example/your_cert_key_here.key
  # SSLCertificateChainFile /etc/ssl/apache/example/your_cert_chain_here.crt
  
  &lt;FilesMatch "\.(cgi|shtml|phtml|php)$"&gt;
  SSLOptions +StdEnvVars
  &lt;/FilesMatch&gt;
  
  BrowserMatch "MSIE [2-6]" \
  nokeepalive ssl-unclean-shutdown \
  downgrade-1.0 force-response-1.0
  # MSIE 7 and newer should be able to use keepalive
  BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
  
  &lt;/VirtualHost&gt;
  &lt;/IfModule&gt;
  
  # vim: syntax=apache ts=4 sw=4 sts=4 sr noet
  </code></pre>
  
  <p>a header checker tool (<a href="http://www.internetmarketingninjas.com/header-checker/" rel="noreferrer">http://www.internetmarketingninjas.com/header-checker/</a>):</p>
  
  <pre><code>http://example.com/wp-admin - 301 Moved Permanently
  http://example.com/wp-admin/ - 302 Found
  http://example.com/wp-admin/ - 302 Found
  …..removed 16 identical responses for brevity….
  http://example.com/wp-admin/ - 302 Found
  </code></pre>
  
  <p>I need help identifying where this redirect is coming from.</p>