GoDaddy’s WordPress Login Loop Locked Me Out of My Own Site

Global Watchdog is reader-supported, with no advertisers and no government entity to answer to. If you enjoyed this article, you can help keep it coming with a one-time donation or monthly support: Support on PatreonDonate on Ko-fi

9 min read

For four days, I could not log in to my own website.

The public site was fine. Readers could read. I could log in from my laptop browser with the same username and password I have used for years. But one door, the door my work runs through, was slammed: I would open the WordPress login page, type my credentials, click Log In, and land on a full-page security check. Just a moment… Performing security verification. Verify you are human. It would spin, declare me verified, and drop me right back on the login form with nothing but “Please log in again.” No wrong-password error. Not ever. Not even when I typed a wrong password on purpose to test it.

If that page is cycling on your GoDaddy WordPress login right now, I have been exactly where you are. Here is what that page actually is, why it loops, what fixed it for other site owners, the exact words I used with GoDaddy support, and how my case ended. Spoiler: GoDaddy closed the case without fixing it, and I work around their wall every day now.

What that page actually is

That full-page takeover, title “Just a moment…”, heading “Performing security verification”, with a little Ray ID code at the bottom, is Cloudflare’s interstitial challenge page. Cloudflare’s own documentation describes it as a gate that holds your request before it reaches the website and evaluates your browser for automated signals. It is triggered by firewall rules, bot management, or rate limiting.

Here is the part GoDaddy does not put on the sales page: GoDaddy’s newer Managed WordPress platform runs a Cloudflare-powered CDN and firewall in front of your site. GoDaddy says so themselves in their platform announcement: “Global enterprise-grade CDN, powered by Cloudflare”, blocking bots and crawlers at the perimeter. You never signed up for a Cloudflare account. You do not need one. GoDaddy put this wall in front of your login, which is why only GoDaddy can take it down.

Two things it is not. It is not a WordPress security plugin acting up; plugins live inside WordPress, and this page stops you before WordPress loads. And it is not the fake version of this screen that criminals use to trick people into running malicious commands. A real Cloudflare check never asks you to press keys, open a Run box, or paste anything into a terminal. If a “verify” page ever asks for that, close it and walk away.

Why it loops instead of letting a verified human through

When you click Log In, the challenge page holds that request hostage. If the check passes cleanly, Cloudflare lets the original request continue to WordPress. If it does not, you get another challenge page. In a loop like mine, the check appears to pass, the screen says it is verifying, and then you are back at the login form. The strongest clue is the missing error message. Type a deliberately wrong password and you still get no incorrect-password warning, because WordPress never receives anything to check. Your login is being stopped at the gate, by a fingerprint the edge security does not like: a flagged IP address, a browser profile with bot-like signals, or, in my case, traffic arriving through a cloud browser.

Cloudflare’s own troubleshooting page for this exact loop lists the usual suspects: strong bot signals from that browser or network, extensions blocking the challenge scripts, cookies not being kept, VPNs and proxies, and plain detection errors. Notice what those have in common. They are all about how you arrive, not who you are. That is why your phone or your laptop sails through while one particular browser gets challenged forever.

What fixed it for other site owners

I dug through everything I could find before and during my support case. Here is what actually worked, in the order I would try it:

1. GoDaddy clears the flag on their side. The closest match to my case anywhere online is a WordPress owner on GoDaddy who posted on the Cloudflare community forum in December 2024: same verify-you-are-human cycle on the WordPress login, same Ray IDs, no Cloudflare account of his own. His final update was three words: “Issue was rectified by GoDaddy.” It is their wall. They have the ladder.
2. Change how you arrive. Turn off any VPN or proxy, try a different network or your phone’s hotspot. If the loop vanishes, the flagged item is your home or office IP’s reputation, not your account.
3. Test in a spotless browser. A private window with extensions off, JavaScript and cookies on, browser up to date. One helper in that forum thread keeps a completely clean “vanilla” Chrome profile for exactly this test. Ad blockers and privacy tools are known to break the challenge scripts.
4. Clear only the Cloudflare cookies. Search your browser’s cookie settings for “Cloudflare” and delete those entries. When the clearance cookie will not stick, the loop will not end.
5. Use the side door to keep working. GoDaddy’s own dashboard has a WP Admin button (older accounts may see it labeled Edit Site) that launches your WordPress dashboard without the login form. It is a bypass, not a cure. It will not rehabilitate a flagged browser, but from a healthy browser it gets you in today.

One thing that will not fix this loop: disabling WordPress plugins. That cures a different, rarer loop that happens inside WordPress, after the login form loads. If the full-page “Just a moment…” screen appears before any WordPress screen, your plugins never get a vote.

The exact words I used with GoDaddy support

Feel free to steal this. It is written to get you past the “let’s reset your password” script in the first minute, because your password was never read:

“This is a Managed WordPress site, and I believe I am being blocked by the Cloudflare layer in front of it, not by WordPress. The login page loads, I submit my credentials, and before WordPress responds I get the full-page check: ‘Just a moment… Performing security verification. Verify you are human.’ It drops me back on the login form with ‘Please log in again.’ I never get a password error, even with a wrong password on purpose, so WordPress is never checking my credentials. It works from a different browser with the same login. I do not have my own Cloudflare account; this is GoDaddy’s bundled CDN and firewall. Please look up this Ray ID in your security events for wp-login.php and wp-admin, tell me which service challenged me, and clear or allowlist my IP for those paths. Please do not ask me to reset my password.”

Two practical tips: screenshot the challenge page so the Ray ID and the time are captured before they rotate, and ask support to confirm any fix in writing before you burn another login attempt. Repeated attempts from the flagged browser just hand the wall more flagged logins to point at.

How my case ended

My case was GoDaddy Case 02015475. On October 7, 2026, I got the final answer by email from Dan in GoDaddy support. Their engineers traced my Ray ID, a463598dcb4cd143, and concluded the problem was my assistant’s cloud browser. That browser’s traffic leaves through Tencent Cloud (AS132203, from IP 43.173.174.61), and to GoDaddy’s edge security that fingerprint reads as a bot-farm pattern, so the verify-you-are-human challenges keep firing. His words: “I’m afraid that we will not be able to remove the block from the IP used by the AI Cloud browser.” Case closed. Not fixed. Closed.

To be fair to GoDaddy, this was not a wrong password, a broken site, or a plugin conflict. Their wall did what walls do when traffic arrives wearing a datacenter fingerprint. To be fair to me, the site owner, the wall was theirs, the exception process was theirs, and the answer was still no.

What works now

Life went on, on my terms. I administer this site from Chrome on my MacBook, same credentials as always, no loop. And the daily work of publishing and maintaining Global Watchdog now runs through the WordPress REST API, which talks to the site directly and never goes near that challenged login page at all. The credentials were never the problem. The site was never the problem. And no amount of password resetting was ever going to change the outcome.

Questions I keep getting asked

Is it my password? Almost certainly not. If WordPress were checking your password, a wrong one would produce a password error. In this loop you never get one, because the request is intercepted before WordPress sees it.

Is that page fake? The real one only ever runs inside your browser. Criminals imitate it with lures that ask you to press Windows+R or paste commands into a terminal. A genuine Cloudflare check will never ask for anything like that.

Will GoDaddy fix it? They can, and for other owners they have. Whether they will depends on what their engineers find at your Ray ID. In my case the flagged traffic came from a cloud browser’s datacenter IP, and they declined to lift the block. Ask anyway, and ask in writing.

How do I keep working while I wait? Log in from a different browser or device, use GoDaddy’s WP Admin button from that healthy browser, and if you do a lot of publishing, ask whoever helps you with your site about the REST API route.

Your turn

Has GoDaddy’s verify-you-are-human page ever locked you out of your own site? What fixed it, if anything did? Tell me in the comments. The next owner stuck in this loop at midnight will thank you, and so will I.

Sources: Cloudflare’s challenge page documentation and loop troubleshooting guide; GoDaddy’s Managed WordPress platform announcement; the December 2024 owner report on the Cloudflare community forum; and my own GoDaddy Case 02015475 correspondence, October 2026.