WordPress "Error: Cookies are blocked due to unexpected output"

What’s actually happening

You submit correct credentials at wp-login.php and get kicked back to the login form with this notice — no wrong-password error, just no session. Your browser isn't actually blocking cookies; WordPress is reporting that something printed bytes to the page before it could send the Set-Cookie header. PHP usually logs a matching "headers already sent by ..." line that names the exact file and line number, which is your fastest route to the culprit.

Common causes

• Blank lines or spaces after the closing ?> in wp-config.php — the single most common cause. Anything after ?> is sent to the browser verbatim.
• A UTF-8 byte-order-mark (those invisible EF BB BF bytes) saved into the top of wp-config.php or functions.php by an editor configured for 'UTF-8 with BOM'.
• A plugin or the active theme's functions.php echoing, var_dumping, or printing a PHP notice during init, before login headers go out.
• A PHP warning/deprecation notice being rendered to the page because display_errors is on in production.
• Whitespace or markup before the opening <?php in any early-loaded file.

How to fix it

1. Read the headers-already-sent line firstTurn on logging (define('WP_DEBUG',true); define('WP_DEBUG_LOG',true); define('WP_DEBUG_DISPLAY',false);) and reproduce the login. wp-content/debug.log will say 'output started at /path/to/file.php:NN'. That file and line is where the stray bytes come from — go straight there instead of guessing.
2. Scrub wp-config.phpOpen wp-config.php and either delete the closing ?> entirely (valid and recommended for PHP-only files) or remove every blank line and space after it. While you're in there, re-save the file as 'UTF-8 without BOM' to kill any byte-order mark.
3. Bisect plugins and themeIf wp-config is clean, rename wp-content/plugins to plugins_off via SFTP to force-disable all plugins and try logging in. If that fixes it, restore the folder and disable plugins one at a time. Then test by switching to a default theme (twentytwentyfour) to rule out functions.php.
4. Turn off error display in productionA visible PHP notice is itself the unexpected output. Set display_errors = Off in php.ini (or ini_set('display_errors',0) early) and route errors to a log instead of the page.
5. Re-save suspect files as UTF-8 without BOMIn VS Code use 'Save with Encoding > UTF-8' (not 'UTF-8 with BOM') for wp-config.php and the theme's functions.php. A BOM is invisible in most editors, so re-saving is more reliable than eyeballing.