iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Most WordPress login failures on Nginx come from a mismatch between the browser, WordPress’s public URL, a reverse proxy, Nginx routing, PHP-FPM, or a cache. Diagnose those layers from the outside in: verify cookies, confirm one canonical HTTPS URL, check proxy headers, validate the Nginx-to-PHP-FPM path, bypass caches, and then isolate plugins. Record the redirect chain and logs before changing configuration so you can identify the first failing layer and undo risky changes.
Identify the exact login failure first
Use the symptom to choose the first branch instead of changing several settings at once. WordPress uses wp-login.php for authentication; visiting /wp-admin/ while logged out normally sends you there.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →| What you see | Most likely layer | First check |
|---|---|---|
| “Cookies are blocked or not supported by your browser.” | Browser cookie policy, cookie domain, HTTPS consistency, plugin, or cache | Enable cookies, clear this site’s cookies, and retry privately |
| The login form reappears after correct credentials | Authentication cookie cannot be stored or is overwritten | Inspect cookies and compare the public URL with WordPress URL settings |
| HTTP and HTTPS redirect repeatedly | Conflicting SSL or proxy scheme handling | Capture every Location header and inspect forwarded-proto handling |
| Credentials appear accepted, then you are logged out | Cookie domain/path, proxy host, cache, or URL mismatch | Check the host receiving the cookie and whether a cache served the response |
| 403 response | Access rule, WAF, rate limit, or permissions | Read the Nginx error log at the time of the request |
| 404 response | Missing WordPress front-controller routing | Verify try_files sends non-file requests to /index.php |
| 500 response or a blank page | PHP-FPM connection, PHP fatal error, or incompatible plugin | Check Nginx and PHP-FPM logs together |
Preserve evidence before making broad changes
Open a private browser window and record the public URL, exact error text, time, and whether the failure affects every user or only one account. Keep a copy of the current Nginx server block, WordPress configuration, and cache settings. Do not test by posting a real password to a command-line tool or by publishing logs that contain session cookies.
Capture a redirect chain without credentials:
curl -I -L --max-redirs 10 https://example.com/wp-login.phpLook for alternating schemes or hostnames, repeated identical Location headers, and whether a response sets a cookie for a hostname different from the address in the browser. Save the WordPress version, PHP version, Nginx version, database version, operating system, and any CDN or reverse-proxy details; those details are essential when a support engineer must reproduce the fault.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
1. Verify browser cookies and clear stale client state
WordPress first writes a temporary wordpress_test_cookie. It then relies on authentication cookies to keep a successful login. If the test cookie cannot be written, WordPress displays the exact message “Cookies are blocked or not supported by your browser.”
- Confirm that cookies are enabled for the site. Check both the normal cookie setting and any per-site exception.
- Clear cookies and cached data for the affected hostname only. This removes stale cookies without signing you out of unrelated sites.
- Retry in a private window with extensions temporarily disabled. A privacy extension, content filter, or browser policy can reject the test cookie.
- Use the browser’s developer tools to inspect the response from
/wp-login.php. Check whetherwordpress_test_cookieand later authentication cookies are present, and note their domain, path, Secure, and SameSite attributes.
If a private-window test works, the server may be healthy; focus on stale cookies, an extension, or a browser policy. If both normal and private windows fail, continue with server-side checks rather than repeatedly deleting cookies.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors2. Make WordPress use one public URL
WordPress must generate links, redirects, and cookies for the same public hostname and scheme that the visitor uses. Compare four values: the URL in the browser, the WP_HOME and WP_SITEURL constants (if defined), and the database’s home and siteurl options. A stale http:// value left after an SSL migration is a common cause of login loops.
Check the values safely
If you can reach the dashboard, open the WordPress URL settings and verify that both addresses use the intended HTTPS hostname. If the dashboard is inaccessible, inspect the options table using your database administration method or WP-CLI. The table prefix may not be wp_, so use the prefix from wp-config.php.
SELECT option_name, option_value
FROM wp_options
WHERE option_name IN ('home', 'siteurl');Back up the database before changing these rows. Correct both values together; leaving one on HTTP or on a different hostname can create a redirect cycle or cause cookies to be scoped incorrectly.
Use configuration constants only deliberately
When a migration or a temporary recovery requires constants, add them to wp-config.php above the line that loads wp-settings.php:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
define('WP_HOME', 'https://example.com');
define('WP_SITEURL', 'https://example.com');Replace the example hostname with the real public address. These constants override the database values, so document the change and remove or revise it after the underlying URL data is corrected. Do not define one constant with a trailing slash or a different scheme from the other.
3. Correct reverse-proxy host and HTTPS handling
A CDN, load balancer, or other reverse proxy can terminate TLS and forward plain HTTP to Nginx. If it sends the internal hostname instead of the public host, or fails to communicate that the original request was HTTPS, WordPress can redirect between schemes or hosts and issue cookies for the wrong domain.
Verify the headers at each hop
- Confirm that the proxy forwards the public
Hostvalue, or a trusted equivalent such asX-Forwarded-Host. - Confirm that the proxy sets
X-Forwarded-Proto: httpsfor an HTTPS visitor and that Nginx passes this fact to PHP. - Make sure only your trusted proxy can set these headers. An arbitrary client must not be able to claim that a request is HTTPS or change the host used for authentication.
- Check that the proxy, Nginx, and WordPress each perform only the redirect they are responsible for. Two independent HTTP-to-HTTPS rules can loop.
Tell WordPress about the original scheme when necessary
WordPress’s reverse-proxy guidance allows the application to use the forwarded host or the correct server name when a proxy overwrites it. If your architecture requires a PHP-level HTTPS override, apply it only when the request came through a trusted proxy and the forwarded value is exactly HTTPS:
if (isset($_SERVER['HTTP_X_FORWARDED_PROTO'])
&& $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') {
$_SERVER['HTTPS'] = 'on';
}Do not copy this snippet blindly to an installation exposed directly to the internet; trusting an unfiltered header can weaken security. Configure the proxy and Nginx to strip client-supplied forwarding headers and set their own values.
4. Validate Nginx routing to PHP-FPM
The standard Nginx pattern serves existing files directly and sends other requests to WordPress’s front controller. The PHP location then passes the selected script to PHP-FPM. A missing or incorrect directive can produce a 404, a download prompt, a 500 error, or a login page that never processes POST data.
Front-controller routing
Your WordPress server block should contain the equivalent of:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
location / {
try_files $uri $uri/ /index.php?$args;
}The final argument preserves the query string. Without the fallback to /index.php, pretty URLs and some login-related requests may never reach WordPress.
PHP-FPM location
A representative PHP location is:
location ~ .php$ {
include fastcgi_params;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass unix:/run/php/php8.2-fpm.sock;
}Use the socket or upstream actually provided by your installed PHP-FPM service; the PHP 8.2 socket above is only an example. fastcgi_pass selects the backend, while SCRIPT_FILENAME must resolve to the real WordPress file path. The request-method, content-type, and content-length parameters are needed for correct POST handling, including login submissions.
Test and reload without hiding errors
- Check the configuration syntax:
nginx -t. - If the test succeeds, reload Nginx rather than stopping it:
systemctl reload nginxon systems managed by systemd. - Submit one login attempt and immediately inspect the Nginx error log and the PHP-FPM log. A connection-refused or missing-socket message points to the upstream; a PHP fatal error points inside PHP or a plugin.
Check filesystem permissions as well: the PHP-FPM worker must be able to read the WordPress files, and the configured document root must match the path used by SCRIPT_FILENAME. Avoid “fixing” a 500 error by granting world-writable permissions.
5. Bypass caches for login and authenticated traffic
Never serve a cached login response to another visitor, and never cache a response that must set or vary authentication cookies. WordPress and Nginx guidance calls for bypassing cache for POST requests, query strings, /wp-login.php, /wp-admin/, and cookies that identify logged-in users.
Define skip conditions in the Nginx HTTP context
map $request_method $skip_cache_method {
default 0;
POST 1;
}
map $request_uri $skip_cache_uri {
default 0;
~^/wp-login.php 1;
~^/wp-admin/ 1;
}
map $query_string $skip_cache_query {
default 1;
'' 0;
}
map $http_cookie $skip_cache_cookie {
default 0;
~*wordpress_logged_in 1;
~*wordpress_sec 1;
}These maps belong in the http context, not inside a server or location block. In the PHP location that uses FastCGI caching, apply every condition to both reading and writing the cache:
fastcgi_cache_bypass $skip_cache_method $skip_cache_uri $skip_cache_query $skip_cache_cookie;
fastcgi_no_cache $skip_cache_method $skip_cache_uri $skip_cache_query $skip_cache_cookie;Apply equivalent exclusions in a CDN or proxy cache. Purge existing cached login and HTML responses after changing the rules, then retry in a private window. If bypassing the cache immediately fixes login, inspect the cache key and cookie rules rather than leaving the entire site uncached.
Recommended Free Tools
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
6. Isolate plugin and theme conflicts
Security, cookie, redirect, SSL, and caching plugins can alter headers or URLs after WordPress has authenticated the user. To test without relying on the dashboard, use an approved maintenance window and rename the plugins directory so WordPress cannot load it:
mv wp-content/plugins wp-content/plugins.offRetry the login. If it succeeds, restore the directory name and disable or remove plugins one at a time until the conflicting component is identified:
mv wp-content/plugins.off wp-content/pluginsUse the same controlled approach for a recently changed theme if the plugin test is inconclusive. Keep a backup and avoid leaving a production site in a partially disabled state. Once the conflict is found, update, reconfigure, or replace that component and retest with caching enabled.
7. Read logs and response headers together
Browser symptoms alone cannot distinguish a proxy loop from a PHP failure. Correlate one request’s timestamp across layers.
- Browser: record the request URL, status, redirect target,
Set-Cookieheaders, and whether the cookie was rejected. - Nginx access log: check the status, request method, upstream status, and response time for
/wp-login.php. - Nginx error log: look for rewrite loops, permission errors, invalid configuration, and failed connections to PHP-FPM.
- PHP-FPM log: look for worker exhaustion, script-not-found errors, and PHP fatal errors.
- WordPress: note the version and any application error recorded at the same time.
A request that never appears in Nginx is failing before the server. A request that reaches Nginx but has no upstream response points to PHP-FPM routing or availability. A successful PHP response followed by repeated redirects points back to URLs, proxy headers, cookies, or cache behavior.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Recovery playbooks for common cases
The cookie error persists after clearing cookies
- Confirm cookies are enabled and test privately.
- Check that the browser hostname, WordPress URLs, and cookie domain all refer to the same public site.
- Inspect whether HTTPS is consistent and whether a proxy is changing the host.
- Bypass page caches and disable plugins that modify cookies or redirects.
- Use the response headers and logs to see whether the test cookie is set and returned.
The form loops back to itself after a successful password
Check the authentication cookie’s domain and Secure attribute, then compare the post-login redirect target with the URL used to submit the form. A cache serving a pre-login response can mimic a failed password, so verify the cache bypass before changing credentials or user records.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
SSL migration created an HTTP/HTTPS loop
Set one canonical HTTPS value in WordPress, database, proxy, and Nginx. Ensure the proxy communicates the original HTTPS scheme and that only one layer performs the external redirect. Purge caches and test the chain with curl -I -L until every hop stays on the same hostname and scheme.
Login returns 404 or 500
For 404, verify the try_files fallback and confirm that /index.php exists under the configured document root. For 500, run nginx -t, verify the PHP-FPM socket or upstream, check SCRIPT_FILENAME, and read the PHP-FPM log for a fatal error. Re-enable plugins only after the base login path works.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Harden the working configuration
Once login works, protect the endpoint without breaking legitimate users. WordPress documents Nginx request limiting for wp-login.php and a similar rule for xmlrpc.php. A starting pattern is:
limit_req_zone $binary_remote_addr zone=wp_login:10m rate=5r/m;Apply the zone in a dedicated exact-match /wp-login.php location, for example with a small burst allowance, while retaining the same FastCGI parameters and upstream as the main PHP location:
location = /wp-login.php {
limit_req zone=wp_login burst=10 nodelay;
include fastcgi_params;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass unix:/run/php/php8.2-fpm.sock;
}Choose a rate and burst that match your users, support procedures, and any shared NAT addresses. Monitor rejected requests after deployment; an aggressive limit can lock out offices or mobile networks. Add an analogous policy for /xmlrpc.php only if that endpoint is needed, and test application integrations after enabling it.
Prevent the next outage
- Keep one documented public hostname and HTTPS scheme across DNS, proxy, Nginx, and WordPress.
- Version-control Nginx and WordPress configuration, and test with
nginx -tbefore reloads. - Exclude login, admin, POST, query-string, and authenticated-cookie requests from every caching layer.
- Record PHP-FPM socket changes during PHP upgrades.
- Keep a recovery account and a tested maintenance method for disabling plugins without the dashboard.
- Retain a short sample of redirect headers and relevant logs whenever a login incident occurs.
Working from the browser outward limits the blast radius: client-state fixes are reversible, while URL and proxy changes affect every generated link and redirect. Change one layer at a time, retest, and keep the evidence that proves which change restored authentication.
Free tools Windows power users keep installed
One-click scans. No signup required.
