After a server move, I'm unable to log in to my site. I get the "ERROR: Cookies are blocked or not supported by your browser. You must enable cookies to use WordPress." error when I try submitting the login form.

I'm positive that my browser supports cookies and that they're not blocked.

I've researched this pretty thoroughly and tried every suggestion I've found:

  • renamed the plugins directory
  • renamed the site theme directory
  • searched the database for instances of the previous URL and replaced those with the new URL
  • updated WordPress to latest version (4.0)
  • defined WP_HOME and WP_SITEURL in wp-config.php

    define('ADMIN_COOKIE_PATH', '/');
    define('COOKIE_DOMAIN', '');
    define('COOKIEPATH', '');
    define('SITECOOKIEPATH', '');
  • tried this hack to wp-login.php: https://wordpress.org/support/topic/cookies-are-blocked-or-not-supported-by-your-browser-1#post-5026171

I can log into the site on my local install, and I can log into the site on our dev server. Any ideas what could be causing this?

  • 1
    Look at the login page's HTML source. Is there anything at all before the initial DOCTYPE line? Even a blank line? If so, then you have some piece of code creating output before the headers are made, in which case this prevents it from setting cookies.
    – Otto
    Commented Oct 22, 2014 at 20:48
  • 2
    This is due to the fact that Wordpress enforce a $secure_cookie control over an encrpted channel for admin logins. Reconfigure your webserver to enforce SSL/TLS. KR.
    – user105503
    Commented Oct 23, 2016 at 12:30
  • If you're using WordPress MU, adding the domain to Domains list in Settings may fix the issue. Commented Dec 12, 2016 at 7:34
  • 3
    This is what worked for me: I changed http to https (added 's') and voila. No more cookie issue. Commented Sep 19, 2017 at 21:25
  • @MahdiTaghizadeh - Can you explain what you mean please in more detail?
    – Greeso
    Commented Apr 4, 2019 at 6:53

8 Answers 8


Add below line to your wp-config.php before /* That's all, stop editing!...*/


/* That's all, stop editing! Happy blogging. */
  • 2
    This solution also worked for me on a multisite installation. I was able to login to the main site but not to the secondary one.
    – Be.St.
    Commented Feb 23, 2018 at 12:49
  • @Be.St., try define('COOKIE_DOMAIN', '');
    – Steve
    Commented Apr 18, 2018 at 2:14
  • 2
    This didn't work immediately for me, but did on a hard refresh (ctrl + f5 in chrome)
    – Dave
    Commented Feb 9, 2019 at 22:39
  • agree with @Dave, I manually cleaned cookie and then it works
    – Neekey
    Commented Feb 19, 2020 at 2:57
  • In case anyone is looking for official documentation that confirms this, they can see this same advice at the bottom of wordpress.org/support/article/…. Commented Mar 20, 2020 at 23:47

It was Varnish.

Our web host had Varnish set up in a Drupal-specific manner, and it was filtering out the cookies that WordPress uses to handle logins.

  • 3
    In my case it was AWS CloudFront which blocked cookies.
    – Mantas
    Commented Sep 8, 2016 at 6:37
  • I saw this with the non secure sitehttp:// but for me everything works when using https://
    – CrandellWS
    Commented Sep 27, 2019 at 17:15

I also had this issue recently, it turned out that although the domain name was pointed towards the website, the wordpress multisite didn't have a record in the database to map the domain name to the correct blog, so when wordpress was trying to set the cookies, it was setting the cookie for the subdomain instead of the mapped domain.


This issue can also be caused by a site_url that doesn't match the exact URL.

In my case, my site_url and home were //, which I use to have the flexibility of using http or https, so I did:

// Identify the relevant protocol for the current request
$protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off' || $_SERVER['SERVER_PORT'] == 443) ? "https" : "http";

// Set SITEURL and HOME using a dynamic protocol.
define('WP_SITEURL', $protocol . '://' . $_SERVER['HTTP_HOST']);
define('WP_HOME', $protocol . '://' . $_SERVER['HTTP_HOST']);

There could be the following issues in your site.

  1. Coding Error
  2. Unnecessary Spaces in Code
  3. Caching & Security Plugin

Check more here: https://www.scratchcode.io/cookies-are-blocked-or-not-supported-by-your-browser/


This happens mainly when you login to backend for the first time.

If you are sure that user and password you've entered are valid ones, you can try simply reloading the page and you will be logged in as normal.

And that's it. After that, your browser will save the required cookie


I have been googled & tried all ways to get rid of this cookie issue. Finally i found two solutions, which could help you.

Solution 1:


Comment following lines 770-773


if ( isset($_POST['testcookie']) && empty($_COOKIE[TEST_COOKIE]) )
    $user = new WP_Error('test_cookie', __("<strong>ERROR</strong>: Cookies are blocked or not supported by your browser. You must <a href='http://www.google.com/cookies.html'>enable cookies</a> to use WordPress."));
    $user = wp_signon('', $secure_cookie);

It might work for some websites and some sites may show blank page. Moreover, this is not recommended,as this file may be overridden after wordpress update so try for second solution.

Solution 2:


Place following code.

 setcookie(TEST_COOKIE, 'WP Cookie check', 0, COOKIEPATH, COOKIE_DOMAIN);
    setcookie(TEST_COOKIE, 'WP Cookie check', 0, SITECOOKIEPATH, COOKIE_DOMAIN);

Updating of your theme may also loose these changes so please place this code in another functions.php, which is under your child-theme folder in your current active theme. Hope, this will help you.

  • 2
    These are really solutions. More like work arounds, not ideal to use this permanently...
    – Jake
    Commented Sep 21, 2016 at 18:52
  • -1 for "Solution" 1 because editing the core is NEVER the correct action. 2 will work but it does not identify the issue.
    – Jeremy
    Commented Apr 25, 2018 at 15:24

I implemented the solution given by wpdevramki and noticed that following issue might surface:

"Notice: Constant COOKIE_DOMAIN already defined in /wp-config.php on line 102"

To resolve this, please comment out the following code in the wp-includes/default-contants.php

if ( !defined('COOKIE_DOMAIN') )
    define('COOKIE_DOMAIN', false);
  • 3
    – Jeremy
    Commented Apr 25, 2018 at 15:27
  • Never modify core code.
    – Drmzindec
    Commented Jul 15, 2020 at 15:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.