1

(I've resolved this - sequencing error in wp-config.php - thanks to this answer elsewhere).


I've moved a site dev to production and everything is working correctly except the login form, which is stuck a loop with this URL:

/wp-login.php?redirect_to=https%3A%2F%2Fwww.example.com%2Fwp-admin%2F&reauth=1

  • It's an https:// site (though the dev site was as well) and uses a www. prefix

With Chrome Devtools and Application > Storage > Cookies (or Network with 'Preserve log' ticked) open: the authentication cookies are being sent - I'm getting about 16 in all (examples below) from the wp-login.php response (straight after clearing cache) including multiple wordpress_sec and WordPress_logged_in.

However every cookie has an expiry date of 1 year ago (July 2018) so immediately disappears.

I've been going through the WP Core source code, the time() - YEAR_IN_SECONDS line mainly seems to be for situations where the password has been reset.

I verified that $user = wp_signon( array(), $secure_cookie ); **is completing successfully and the user was being sent to /wp-admin, but then redirected from there back to wp-login.php*

Also:

  • WordPress_test_cookie has no expiry. It has the correct domain (including www.), / for the path and is Secure, according to devtools
  • siteurl and home option values are correct, FQDN with correct protocol and URL definitely spelt correctly (I used wp option get/set, but have also defined them at the top of wp-config.php)
  • user/password combinations I've tested are definitely valid (deliberately incorrect entry gives error as expected). I also used WP CLI to reset them, create a test account
  • I've tried toggling the theme back to the default one
  • I've tried using WP CLI to regenerate the permalinks and delete transients
  • I'd regenerated the salts (the location of the salts in the config file turned out to be the solution, see my answer)
  • I've tried deactivating various plugins
  • It's not a multisite, but I tried defining DOMAIN_CURRENT_SITE anyway - that was my resolution to a similar problem with a different WPMU install
  • WP_DEBUG_LOG is true and nothing is being written to wp-content/debug.log
  • I've been testing in Chrome with a cleared cache
  • The rest of the site is working fine (served via Nginx with a working LetsEncrypt cert).

Any suggestions?

WP core 5.2.2, Nginx 1.14.2, PHP 7.3.4-2, MySQL 10.3.15-MariaDB-1 on Debian 10.0 (Buster)

Sample cookies in response:

set-cookie: wordpress_test_cookie=WP+Cookie+check; path=/; secure
set-cookie: wordpress_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/wp-admin
set-cookie: wordpress_sec_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/wp-admin
set-cookie: wordpress_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/wp-content/plugins
set-cookie: wordpress_sec_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/wp-content/plugins
set-cookie: wordpress_logged_in_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/
set-cookie: wordpress_logged_in_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/
set-cookie: wp-settings-0=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/
set-cookie: wp-settings-time-0=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/
set-cookie: wordpress_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/
set-cookie: wordpress_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/
set-cookie: wordpress_sec_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/
set-cookie: wordpress_sec_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/
set-cookie: wordpressuser_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/
set-cookie: wordpresspass_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/
set-cookie: wordpressuser_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/
set-cookie: wordpresspass_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/
set-cookie: wp-postpass_e3a619e8946da863a424fa3e2712b99b=+; expires=Fri, 27-Jul-2018 18:40:34 GMT; Max-Age=0; path=/
status: 200
1

This was caused simply by the salts in wp-config.php being at the end of the file, after the call to wp-settings.php (they were inserted by an Ansible script) rather than above the line:

/* That's all, stop editing! Happy publishing. */

:(

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.