How to Fix 401 Unauthorized Error (Login Required)
What the 401 Unauthorized error means
HTTP status 401 means "unauthorized." Your browser reached the server with no trouble, and the server understood the request — but it will not serve the page until you authenticate. Think of it as a locked door: the building is open, but this particular room needs a key. You will see messages like "401 Unauthorized," "Authorization Required," "HTTP Error 401," or a repeated login popup that keeps coming back no matter how many times you enter your details.
The name is slightly misleading: in web terminology, "unauthorized" here means "unauthenticated." The server is not saying you lack permission — it is saying it does not know who you are yet. That is also the key difference from a 403 Forbidden error: a 401 is an invitation to log in, while a 403 is a flat refusal. If you are logged in and still seeing a 401, your session is broken somewhere between your browser and the server, which is exactly what the steps below repair.
Common causes
- Expired login session: most sites log you out after a period of inactivity — your old bookmark or tab then hits a page that needs a fresh login.
- Wrong or stale credentials: an outdated password in your password manager, or a browser login popup answered with the wrong details, triggers a 401 immediately.
- Corrupt or blocked login cookie: a damaged session cookie, or a browser that blocks cookies, prevents your login from "sticking" between pages.
- Expired links and tokens: shared URLs, email links, and saved links containing session tokens or one-time codes stop working once they expire.
- Server asking for auth it should not: a misconfigured .htaccess file, a forgotten staging password, or an over-aggressive security plugin can demand a login on public pages.
How to fix the 401 Unauthorized error — step by step
Start with the visitor steps (1–4). If you own the site, step 5 is where most persistent 401s get fixed.
- Log out completely and log back in. Click Log out on the site (not just close the tab), wait a few seconds, then log back in with your credentials. This gives you a brand-new session. If the site uses a browser login popup instead of a login page, press Ctrl + F5 to retry and enter your credentials carefully — the 401 appears when the browser sends no credentials or the wrong ones. If you use a password manager, type the password manually once to rule out an outdated saved entry.
- Clear the site's cookies and try an incognito window. A stale or corrupted login cookie is one of the most common causes of a looping 401. Press Ctrl + Shift + Delete, set the range to All time, check Cookies and other site data, and click Clear data. Then open an incognito window (Ctrl + Shift + N) and log in there. Incognito runs without your old cookies and extensions, so if the page works in incognito but not in your normal window, a cookie or extension is the culprit.
- Check the URL and drop expired session data. Look at the address bar: links with tokens, session IDs, or long query strings (the ?sid=... or &token=... parts) can expire, and an old bookmark can point at a page that now requires a fresh login. Strip everything after the main page path or navigate to the page through the site's own menus instead of the bookmark. If you arrived from an email link or a shared URL, that link may have expired — log in to the site's homepage first, then find the content from there.
- Temporarily disable your VPN, ad blocker, and extensions. VPNs, proxies, ad blockers, and aggressive privacy extensions can strip or block the authentication headers your browser sends, which makes the server think you never logged in. Turn off your VPN and extensions, then hard-refresh with Ctrl + F5 and try again. If the 401 disappears, re-enable them one at a time to find the offender. Corporate networks and school Wi-Fi can have the same effect — try your phone's mobile data to confirm.
- Site owner: check your authentication setup. If you own the site, a 401 often means your server asks for a login it should not. Check .htaccess or your server config for password-protection rules (AuthType, Require valid-user) applied to the wrong folder. In WordPress, look at your security plugin settings: two-factor, login protection, or IP-based rules can block legitimate users. Review your recent changes — a new plugin, CDN rule, or staging-password feature turned on by mistake is a frequent trigger. Temporarily disable the suspect plugin or rule and test the affected page.
- Try another device, then report the problem. If the 401 follows you everywhere, try logging in on your phone or another browser to rule out your device. If it fails there too, the problem is with your account or the site — reset your password through the site's official password-reset page and try again. Still stuck? Contact the site owner with the exact URL, the time it happened, and whether you were logged in. As an owner receiving these reports, check your server's error log for 401 entries: the log shows exactly which requests were denied and why.
Did this fix it? Quick checklist
- The page loads without the 401 message
- You stay logged in when moving between pages
- It works in an incognito window and on another network
- Site owners: no stray password-protection rules remain in place
If the login popup keeps reappearing even with the correct password, check your system clock — a badly wrong date or time can invalidate session cookies and security tokens. On the owner side, if the 401 started right after moving hosts or changing CDN settings, confirm the site's authentication headers are passing through your CDN instead of being stripped.
Frequently asked questions
What does a 401 Unauthorized error mean?
It means the page requires authentication and your browser did not provide valid credentials — in plain English, login required. The server understood the request but will not serve the page until you prove who you are. The most common causes are expired login sessions, wrong or stale credentials, corrupt login cookies, or a server asking for a login it should not.
What is the difference between a 401 and a 403 error?
A 401 means unauthorized: you need to log in, and the server is asking you to authenticate. A 403 means forbidden: the server knows who you are (or does not care) and is refusing access anyway. Logging in again can fix a 401, but it almost never fixes a 403, which is about permissions, not identity.
Why do I keep getting a 401 right after I log in?
This usually means your login is not sticking. Your browser may be blocking the session cookie, a stale cookie may be overwriting the new login, or your saved password may be outdated. Clear the site's cookies, log in from an incognito window, and type the password manually once. Browser privacy settings that block third-party cookies can also cause this on sites that log you in through another domain.
How do website owners fix 401 errors for their visitors?
Check that password-protection rules in .htaccess or your server config are applied only to the folders that need them, and review security plugin settings for login rules that may be too aggressive. Check your server error logs for 401 entries — they show which requests are being denied and why. If it started after a recent change, roll back the plugin, CDN rule, or staging password that triggered it.