WordPress logs out users any time their protocol switches between HTTPS and HTTP. This is a real problem in a commerce environment where checkout forces SSL.
I've run into this a handful of time over the years and I've normally resolved the issue by going full SSL across the entire site. The problem is that this particular client sees HTTPS as additional overhead (not open for debate) and doesn't want it enabled anywhere it's not required by a secure transaction.
Basically, I can log into the site using https, switch protocols in the URL, and I'll be insta-logged. Works the same way in both directions.
I understand that changing the protocol is invalidating the session, what I don't understand is how to work around it; bearing in mind that I don't have any choice in the matter.
- Running the latest WordPress with a commerce-oriented plugin load. Nothing that isn't working without incident on other client sites.
- Running as a node on a WordPress multi-site network (this is more likely the culprit)
- Server is running on Ubuntu via AWS. I have shell access but I don't have a mandate to tinker. Too many other things can go wrong.