I host a Wordpress website for a client, and suddenly a few weeks ago they can no longer access the admin section. They are behind a Barracuda F600 firewall. Outside the firewall, wp-admin loads fine. They can login, view the admin options, etc. Behind the firewall they get the login screen, but as soon as they click login the site just spins. The front-end of the site loads fine behind the firewall, however. And after they give up and go to the front-end, the admin bar appears at the top, so they appear to have authenticated.

I ran tcpdump and it looks to me like the page is being sent from my server. Apache access log shows the page delivered w/ a 200 status and is the same payload size as when I login. I disabled Wordfence and the same issue happens. When I view the source after stopping the page load, the source is just empty. No Apache errors of any kind.

Normally I would say "It's the firewall" but a tech actually disabled all rules on the firewall and just had ANY/ANY incoming rule and the same thing happened. On every other machine outside that network loads wp-admin section fine. And, to top it off, their website is Wordpress and they can access their own admin page fine behind the firewall.

Any ideas?

  • If a stock vanilla install of WordPress is doing this then the issue is definately not WordPress, WP does nothing like this. Try it with a site hosted elsewhere to see if the issue is at your end, or if the server is misconfigured, but this is definately a dev ops problem, not a WP problem. Perhaps Server Fault or SuperUser would be more appropriate?
    – Tom J Nowell
    May 23, 2018 at 14:53
  • Your not telling this is https or mixed? Have they upgraded their browsers? Have you tried with your laptop behind their firewall? @TomJNowell is probably right with Server Fault or SuperUser I guess too. May 23, 2018 at 15:11
  • Just standard http calls. No SSL now. My next thought was to move it to another server and see if the issue persists there, as well. I don't think it's WP either, but thought I'd ask. Thanks!
    – Joel F.
    May 23, 2018 at 15:24

1 Answer 1


It turns out it WAS the firewall after all. I asked their IT guy to create a ticket w/ Barracuda JIC. Barracuda found the issue and created a rule to allow it in. It had to do with IPS (not sure what that is).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.