You try to open a page — or log in to wp-admin — and the server answers 401 Unauthorized. The 401 Unauthorized error fix starts with what the code means: “I don’t know who you are — please prove it.” Unlike 403 Forbidden (the server knows you and still says no), a 401 is an authentication failure: missing, wrong, or rejected credentials somewhere in the chain. This 2026 guide covers both sides — what visitors can do, and what site owners must check.
On WordPress, 401s cluster around three scenarios: wp-admin logins blocked by a security plugin or firewall, password-protected directories (staging sites, or wp-admin hardened via hosting panel), and API requests with bad or missing Authorization headers. The fix depends entirely on which scenario you are in — so diagnose first.
What Causes the 401 Unauthorized Error
- Wrong or expired credentials: typos, case errors, changed passwords, or stale saved logins.
- Password-protected directory: wp-admin or staging protected via hosting panel (“Directory Privacy”) or
.htaccessBasic Auth. - Security plugin blocking you: Wordfence, Sucuri, or iThemes blocking your IP or the login page after updates.
- Firewall/CDN challenge: Cloudflare or Sucuri firewall caching an old block on the login URL.
- Corrupted login cookies: stale auth cookies looping the login into a 401.
- Bad API credentials: missing “Bearer” space, truncated tokens, or revoked WordPress Application Passwords.
- Expired SSL: some servers reject requests with a 401 when the certificate is invalid.
How to Fix the 401 Error: 8 Steps
Step 1: Re-enter credentials carefully
Retype the username and password — credentials are case-sensitive, and copy-paste often adds a trailing space. Use the site’s “Lost your password” flow rather than guessing repeatedly; too many wrong attempts trigger IP blocks that look like a persistent 401.
Step 2: Clear cookies and try private mode
Clear cookies for the affected site, then retry in a private/incognito window. Corrupted auth cookies are a classic cause of login-loop 401s. If private mode works, the problem was your stored site data, not the server.
Step 3: Check for password-protected directories
If wp-admin itself demands a login before the WordPress login screen, someone enabled directory protection. In your hosting panel, open “Directory Privacy” or “Password Protected Directories”, find wp-admin, and disable it (or make sure you are using the right directory credentials — they differ from WordPress logins).
Step 4: Purge the firewall cache
If you use Cloudflare, purge the cache (Caching → Purge Everything) — a cached firewall challenge can 401 the login page. For Sucuri, clear the firewall cache from its dashboard. Then clear your browser cache and try logging in again.
Step 5: Deactivate plugins via SFTP (if locked out)
Locked out of wp-admin entirely? Connect via SFTP or the hosting file manager, go to /wp-content/, and rename the plugins folder to plugins-disabled — this deactivates everything at once. If login works, rename it back and reactivate plugins one by one to find the culprit (usually a security plugin).
Step 6: Inspect .htaccess for stray auth rules
Look for AuthType Basic / Require valid-user blocks in .htaccess that should not be there — leftover staging protection is a common surprise. Remove or comment out the block, keeping a backup of the file first.
Step 7: Fix API 401s
For REST API 401s: verify the Authorization header format (Bearer <token> — with the space), regenerate WordPress Application Passwords under Users → Profile if revoked, and check that security plugins are not blocking REST API access for the calling IP. Test with curl -u "user:pass" to isolate header issues.
Step 8: Check SSL and contact the host
Verify the SSL certificate is valid and not expired — renew with certbot renew or via the hosting panel. If nothing above helps, contact your host with the exact URL, time, and error: server-side auth modules and ModSecurity rules are their territory. For permission (not authentication) problems, see our 403 Forbidden fix.
How to Prevent 401 Errors
Use a password manager so credentials are always exact, keep one admin email with reliable password-reset access, and document any directory-level protection you enable (staging passwords cause more lockouts than hackers do). Keep security plugins updated but test logins after major updates. A periodic login test with a free site monitoring tool catches auth breakage before it locks you out at the worst moment.
Conclusion
401 means “prove who you are”: re-enter credentials cleanly, clear cookies, check directory protection and firewall caches, and deactivate plugins via SFTP if locked out. For APIs, fix the Authorization header and application passwords. Work the list in order and access returns. For more access-error fixes, follow the KamiWeb blog.