Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWordPress login failures on Nginx are usually caused by a mismatch between the browser’s cookies, the site’s public URL, a reverse proxy’s host or HTTPS headers, Nginx-to-PHP-FPM routing, or a cache serving the wrong response. Work from the outside in: preserve the redirect and log evidence, verify cookies and one canonical URL, then check proxy headers, Nginx routing, cache bypasses, and plugins.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
The exact symptom determines the first check. A cookie warning points to browser or cookie-domain handling; a form that reloads points to cookies, URLs, or caching; an HTTP/HTTPS loop points to proxy or canonical-scheme settings; and a 403, 404, or 500 requires route and PHP-FPM inspection.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Identify the failure before changing anything
Open a private browser window and record exactly what happens after submitting valid credentials. Do not begin by changing several server settings at once: a broad change can erase the evidence needed to find the original fault.
| Observed behavior | Most likely layer | First check |
|---|---|---|
| WordPress says “Cookies are blocked or not supported by your browser.” | Browser cookie acceptance, cookie domain, HTTPS, or a plugin | Enable cookies, clear the site’s cookies, and retry privately |
| The login form returns after submission without an error | Authentication cookie, canonical URL, cache, or plugin | Inspect the response for a Set-Cookie header and bypass page caching |
| The browser alternates between HTTP and HTTPS | Conflicting proxy, Nginx, or WordPress scheme settings | Trace the redirect chain and compare the public scheme with WordPress settings |
/wp-admin/ returns 403 or 404 |
Nginx location rules, filesystem permissions, or an access rule | Check the server block and the access/error log |
| The page returns 500 or PHP-FPM errors | FastCGI routing, PHP configuration, or PHP code | Check the Nginx error log and the PHP-FPM service log |
| Credentials are accepted, then the user is immediately logged out | Cookie scope, forwarded host/scheme, cache, or conflicting URLs | Compare the host and scheme in every redirect and inspect authentication cookies |
Preserve evidence and establish a safe baseline
Before editing Nginx or wp-config.php, save a copy of the active configuration and note the WordPress, PHP, Nginx, database, operating-system, and proxy or CDN versions. Keep the timestamp of a failed attempt so log entries can be matched to it.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
- Save the current Nginx server block and any included FastCGI or cache files.
- Record whether the public address includes
www, a subdomain, a nonstandard port, or a path prefix. - Capture one failed redirect sequence and the response headers. A command such as
curl -sS -D - -o /dev/null https://example.com/wp-login.phpshows headers for one request; repeat it with the exact URL that fails. Use-Lonly when you also want to follow redirects and inspect the complete chain. - In browser developer tools, preserve the request to
wp-login.php, its status,Locationheader,Set-Cookieheaders, and the cookie values shown for the site. - Note whether a reverse proxy, load balancer, DNS proxy, or CDN sits between the browser and Nginx. The public host and scheme must survive that hop.
Step 1: rule out browser and cookie problems
WordPress first writes a temporary wordpress_test_cookie. It then uses authentication cookies after a successful login. If the test cookie cannot be written or returned, WordPress displays the exact message “Cookies are blocked or not supported by your browser.”
- Enable cookies for the public hostname. Check both regular and third-party cookie restrictions if the login is embedded in another origin.
- Clear cookies and cached data for only the affected site. A stale cookie from an earlier hostname or HTTP migration can remain even when the page looks correct.
- Retry in a private window. If private mode works, an extension, cached service-worker response, or old cookie in the normal profile is involved.
- Use the browser’s storage panel to confirm that
wordpress_test_cookieappears and that an authentication cookie is set after submitting the form. - Check that the browser is not switching between two hostnames, such as an apex domain and a
wwwaddress. A cookie set for one host is not automatically available to the other.
If the test cookie never appears, continue with the URL, HTTPS, and proxy checks below rather than repeatedly changing passwords. Password validation cannot succeed reliably when the browser cannot retain the session.
Step 2: make the public URL consistent
WordPress must have one public hostname and one scheme. Compare the address in the browser with the WP_HOME and WP_SITEURL constants in wp-config.php, then compare both with the database values in the home and siteurl options. A stale http value left after an SSL migration commonly creates a redirect loop or a cookie that is unusable on the HTTPS page.
Check the configuration file
Look for definitions similar to these, using the real public address rather than an internal hostname:
define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );Do not define one value with www and the other without it unless the web server deliberately redirects one to the other. Also look for an old COOKIE_DOMAIN definition. Remove a stale override or correct it only when a deliberate multi-host setup requires it.
Check the database values
With a database backup and the correct table prefix, inspect the options directly:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
SELECT option_name, option_value
FROM wp_options
WHERE option_name IN ('home', 'siteurl');The prefix may not be wp_. If these values disagree with the public address, correct them using the site’s normal administration or database procedure, then clear caches. Changing canonical URLs affects every generated link and redirect, so make this change only after confirming the intended public hostname and scheme.
Step 3: verify reverse-proxy host and HTTPS handling
A proxy can terminate TLS and send plain HTTP to Nginx. It can also replace the public host with an internal hostname. WordPress then generates a redirect or cookie for the wrong origin, producing an HTTP/HTTPS loop or an immediate logout.
What the proxy must preserve
- The original public host must be passed through as the host WordPress uses for links and cookies.
- The application must be told that the original request was HTTPS when TLS ended at the proxy.
- Only a trusted proxy should be allowed to supply forwarded host and scheme headers. Do not blindly trust a header that any internet client can set.
Inspect the request reaching Nginx and the response leaving it. If the proxy sends an internal host, configure it to preserve the public host. WordPress’s reverse-proxy guidance also allows the application to use a trusted HTTP_X_FORWARDED_HOST value or the correct SERVER_NAME when the proxy has overwritten the host.
Tell WordPress when the original request was HTTPS
When a trusted proxy sets HTTP_X_FORWARDED_PROTO, a common wp-config.php pattern is:
if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && 'https' === $_SERVER['HTTP_X_FORWARDED_PROTO'] ) {
$_SERVER['HTTPS'] = 'on';
}Place this before WordPress loads, and use it only when the header is inserted by infrastructure you control. If the proxy does not set a reliable forwarded scheme, fix the proxy instead of guessing in PHP. Afterward, verify that one request to the public HTTPS URL stays on that URL and that no redirect points to an internal name.
Step 4: check Nginx routing to WordPress and PHP-FPM
For a standard WordPress installation, Nginx should serve real files directly and send other paths to index.php. The documented pattern is:
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
location / {
try_files $uri $uri/ /index.php?$args;
}
location ~ .php$ {
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_pass unix:/run/php/php8.2-fpm.sock;
}The socket name and document root must match the installed PHP-FPM service and the actual WordPress files. Some systems use a TCP upstream instead of a Unix socket. The important checks are that try_files ends in /index.php?$args, fastcgi_pass reaches a running PHP-FPM backend, and SCRIPT_FILENAME resolves to the requested PHP file. POST requests also need the request-method, content-type, and content-length parameters; an incomplete parameter set can make form submissions fail even when a GET request works.
- Run
nginx -tand correct every reported syntax or include-file error. - Confirm the WordPress document root contains
index.phpandwp-login.php. - Confirm the PHP-FPM socket or upstream exists and that its service is running.
- Reload Nginx only after the test succeeds, using the service procedure for the operating system.
- Submit the login again while watching the Nginx error log and PHP-FPM log.
A 404 for wp-login.php usually means the request is reaching the wrong server block or document root. A 502 indicates that Nginx cannot reach PHP-FPM. A 500 requires the PHP-FPM and WordPress error details rather than another rewrite-rule change.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchStep 5: bypass caches for login and authenticated requests
Authentication responses cannot be treated like public pages. A cached login form may omit a fresh test cookie, and a cached post-login response may be delivered to the wrong user. Nginx FastCGI caching and any upstream CDN or proxy cache need equivalent exclusions.
| Request condition | Required cache behavior |
|---|---|
| POST request | Do not read from or write to the page cache |
| Any query string | Bypass unless the cache key and application behavior have been explicitly designed for it |
/wp-login.php |
Bypass the cache |
/wp-admin/ |
Bypass the cache |
| A cookie indicating a logged-in user | Bypass the cache and do not store the response |
| A response that sets or varies authentication cookies | Do not store it as a public page |
In an Nginx FastCGI setup, the bypass variable is commonly applied to both fastcgi_cache_bypass and fastcgi_no_cache. The exact syntax depends on the existing cache design, but the logic should cover all of the conditions above:
set $skip_cache 0;
if ($request_method = POST) { set $skip_cache 1; }
if ($query_string != '') { set $skip_cache 1; }
if ($request_uri ~* /wp-login.php) { set $skip_cache 1; }
if ($request_uri ~* /wp-admin/) { set $skip_cache 1; }
if ($http_cookie ~* wordpress_logged_in_) { set $skip_cache 1; }
fastcgi_cache_bypass $skip_cache;
fastcgi_no_cache $skip_cache;Adapt the expressions to the server’s existing configuration and test with a logged-out and logged-in browser. A CDN or reverse proxy must receive the same exclusions; changing only Nginx does not help if the outer cache still serves an old redirect or page.
Step 6: isolate plugin and theme conflicts
WordPress identifies plugin conflicts as a possible cause of cookie and login failures. Isolate them only after recording the current state.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
- Put the site in an approved maintenance window if visitors or editors are active.
- Disable all plugins through the normal administration interface if it is accessible. If it is not, rename
wp-content/pluginsto a temporary name such asplugins.offusing the server’s file manager or shell. - Retry the login in a private window and inspect whether the symptom changes.
- If the login works, restore the directory name and reactivate plugins one at a time, testing after each activation.
- Check security, SSL, redirect, cookie, and caching plugins first because they can alter headers or canonical URLs before the request reaches WordPress.
Use the same controlled process for a recently changed theme or must-use plugin. Do not leave all plugins disabled as a permanent fix; identify the conflicting component and update or reconfigure it.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use the symptom to choose the next branch
Cookie error on the login page
Confirm that the browser accepted wordpress_test_cookie, then compare the cookie’s domain and secure attributes with the URL in the address bar. A cookie scoped to an old hostname, a mixed HTTP/HTTPS page, or a proxy that hides the HTTPS state can all prevent the test from succeeding. Once the public URL and forwarded scheme are consistent, clear the old cookie and retry.
The form simply returns to itself
Check whether the POST response sets an authentication cookie and whether a cache served the same response before and after submission. Exclude the login path, POST requests, query strings, and logged-in cookies from every cache layer. If no cookie is set, return to the canonical-URL and proxy checks; if a cookie is set but the next request loses it, inspect its host, path, and secure scope.
Redirects alternate between HTTP and HTTPS
List every hop and the component that issued it. Then choose one place to enforce HTTPS and make the proxy, Nginx, and WordPress agree about the resulting scheme. Conflicting redirects at more than one layer are the usual cause; removing one rule without correcting the forwarded scheme can simply move the loop.
Recommended Free Tools
403 or 404 responses
Verify that the request is handled by the intended server block, that the document root contains wp-login.php, and that no location or access rule blocks /wp-admin/. A 404 from the wrong virtual host is different from a missing file, so compare the response headers and the server name selected by Nginx.
500 or 502 responses
Read the Nginx error log at the exact failure time. A 502 normally means the configured PHP-FPM socket or upstream is unavailable. A 500 requires the PHP-FPM log and any WordPress debug entry; do not hide the underlying error by adding more rewrite rules.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Login succeeds, then the session disappears
Compare the host and scheme before and after login, inspect the authentication cookie’s domain and secure flag, and confirm that no cache serves a logged-out response to an authenticated request. A proxy host mismatch and a cache that ignores the logged-in cookie are especially common when the login page itself appears normal.
Capture logs and environment details for escalation
If the fault remains, collect a single reproducible failure rather than sending a general statement that login is broken. Include:
- The complete redirect chain and response headers for the public login URL.
- Browser cookie names and the domain, path, and secure behavior shown by developer tools. Do not publish cookie values or passwords.
- Nginx access and error-log entries covering the failed request.
- PHP-FPM log entries for the same timestamp.
- WordPress, PHP, Nginx, database, and operating-system versions.
- The active server block, relevant FastCGI parameters, cache exclusions, and whether a proxy or CDN terminates HTTPS.
- The exact symptom after plugins were disabled, if that test was performed.
These details let an administrator distinguish a browser problem from a URL, proxy, routing, cache, or plugin fault without repeatedly changing production settings.
Harden the recovered login endpoint
After login works, add a rate limit rather than relying on repeated manual blocking. WordPress documents Nginx’s limit_req_zone and a dedicated /wp-login.php location, with a similar rule for /xmlrpc.php. Keep the limit appropriate to the site’s legitimate traffic and operational policy; a very strict value can lock out editors behind one shared address.
limit_req_zone $binary_remote_addr zone=wp_login:10m rate=1r/s;Use the zone in a dedicated login location that still passes the request to the same PHP-FPM handler as the rest of the site:
location = /wp-login.php {
limit_req zone=wp_login burst=5 nodelay;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass unix:/run/php/php8.2-fpm.sock;
}The rate and burst above are an example starting policy, not a universal benchmark. Confirm that the dedicated location preserves the POST parameters and does not bypass the cache exclusions. Apply an equivalent, separately considered rule to /xmlrpc.php if that endpoint is enabled.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Final recovery checklist
- The browser accepts cookies and a private-window test behaves the same as the normal profile.
WP_HOME,WP_SITEURL, databasehome, and databasesiteurldescribe one public hostname and scheme.- The proxy preserves the public host and communicates the original HTTPS state to Nginx and WordPress.
- Nginx sends non-file requests to
/index.php?$argsand sends PHP requests to the correct PHP-FPM backend. SCRIPT_FILENAMEresolves to the real WordPress path, and POST parameters reach PHP.- Login, admin, POST, query-string, and logged-in-cookie requests bypass every page cache.
- Plugins or themes have been re-enabled one at a time after isolation.
- The redirect chain, headers, and logs show a stable session before rate limiting is enabled.
Most Nginx login incidents are resolved by aligning those boundaries rather than by changing the WordPress password. Preserve evidence, make one reversible change at a time, and retest from the public URL after each layer is corrected.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
