When valid credentials return a customer to the same form, WordPress may have authenticated them but the next request cannot see the login cookie. Alternatively, a cache or redirect may be serving the logged-out page after successful authentication.
Do not reset passwords repeatedly. First determine whether authentication failed or session recognition failed.
Observe the complete login request
Use a controlled customer account in a private browser. Open Network tools, submit once and inspect the response status, Location header and subsequent requests.
Check whether WordPress sets authentication cookies and whether the browser sends them to the redirected My account URL.
Record without cookie values:
- submitted host and HTTPS scheme
- response status/redirect destination
- cookie domain, path, Secure and SameSite flags
- final page cache statusNever publish cookie contents or use a real customer’s password.
Confirm the credentials separately
Try the controlled account through the standard WordPress login route if business policy permits. A clear “incorrect password” error is different from a successful login followed by a loop.
Check whether the account is blocked, awaiting approval or forced through two-factor authentication. Membership and security plugins may apply customer-specific restrictions.
Do not disable account security globally to make one test work.
Align domain and HTTPS settings
WordPress Address, Site Address and the public My account URL should use one canonical host. Cookies written for www.example.com may not accompany a redirect to example.com.
After an HTTPS or proxy migration, WordPress must detect secure requests correctly. Otherwise Secure-cookie and redirect behaviour can conflict.
Inspect wp-config.php, database options and reverse-proxy settings carefully. Do not add hard-coded cookie-domain constants unless evidence shows they are required; incorrect values can lock out every user.
Exclude account pages from cache
My account and login responses must not be shared full-page cache. Inspect Cloudflare, hosting and WordPress cache headers in the final redirected response.
A logged-in cookie bypass rule should run before cache lookup, but the account route should generally be excluded outright. Purge cached logged-out copies after correction and test once cache is warm.
Static assets can remain cached; personalised account HTML cannot.
Review redirect customisation
Themes, membership plugins and custom code may redirect after wp_login, template routing or account authentication. Conflicting filters can bounce between two URLs.
Search maintained code for login redirect hooks and redirects targeting My account:
add_filter( 'woocommerce_login_redirect', function ( $redirect, $user ) {
// Return one validated local destination; avoid recursive login routes.
return $redirect;
}, 10, 2 );Do not use unvalidated external redirect parameters. Preserve WordPress’s safe redirect protections.
Inspect security and consent controls
A web application firewall may block the POST or challenge the redirect. Match timestamps with firewall events. Create a narrow correction rather than allowing all login traffic.
Consent tools should not delete WordPress authentication or WooCommerce functional session cookies after a customer rejects optional tracking. Test each consent state in separate browser profiles.
Browser privacy extensions can provide a useful comparison, but the store should work in mainstream privacy settings.
Repair and test account continuity
Correct the canonical host, HTTPS detection, cache exclusion, cookie setting or redirect conflict demonstrated by evidence. Clear cookies only in the test browser after deploying.
Test login, logout, password reset, account navigation and login during checkout. Confirm one customer cannot access another account and that the cart behaves according to the store’s merge policy.
Recurring care should test customer authentication after domain, SSL, cache, consent and membership changes. A working administrator session does not prove customer login works because administrators often bypass the exact layers causing the loop.