WooCommerce: Login issues unless cookies are cleared

Hey @databell96,

This does seem troublesome. But, just to be certain that Wordfence is contributing to it, does deactivating in these situations resolve the issue?

Please let me know.

Thanks,

Gerroald

I haven’t tried yet. I’m afraid to turn it off because I can’t replicate the issue and this is a fairly large client who’s site has been hacked before (in Magento, not WordPress which we moved to last Fall). It’s some customers who have had the issue and it seems going to an incognito window solves it, but who really wants to shop that way?

Hey @databell96,

We really need to know if Wordfence is contributing to this to troubleshoot it, or else it’s a guessing game they may not get us anywhere. If you’re not able to deactivate Wordfence are you able to create a staging site on the same server to test this?

Please let me know.

Thanks,

Gerroald

Gerroald,

Actually I just got off the phone with someone who had an issue accessing the site. However, in her case it was because of an incorrect password. Nothing WF did. There was also an issue of a password reset email not going through, but that’s due to the mail server, I would imagine.

Unfortunately, we can’t just deactivate WordFence and just wait. Too risky. The client won’t spend the money for a staging server, so we don’t have that either at our disposal.

All I can do is wait for a email from a frustrated consumer, contact him or her and then turn off WF for a few minutes to see if an order goes through. Which is why I did the call just now but it wasn’t WF related.

Hey @databell96,

Thanks for the update.

This sounds very frustrating and I am sorry to hear that you’re having to deal with it. I hope you are able to track this down. If you do find that it’s Wordfence please let us know.

Thanks,

Gerroald

So I have an update. Got another customer who could not login. I called her and first had her go to /my-account. We have a Recaptcha there. The I’m not a robot checkbox. When she went there, she added her username (really email address) and password, checked on the Captcha and then the password disappeared. Then I decided to just have her go to the checkout screen and try again. This time, she got a message she couldn’t login because her password was incorrect. Which was odd, because that was the problem with the previous customer, and she said it was correct. I reset the password and then she got in. All of this while WordFence was off.

Mot sure that really helps in anything, but it was quite interesting.

So I finally got an example. Customer today using her iPhone couldn’t login, said her password was incorrect, changed it, logged in, then the contents of her cart disappeared. So I turned off WordFence. The cart came back and she could complete her order1

So it’s definitely a WordFence issue. No doubt about it now. But how to fix?

Hi @databell96

When you said, “When she went there, she added her username (really email address) and password, checked on the Captcha and then the password disappeared. Then I decided to just have her go to the checkout screen and try again. This time, she got a message she couldn’t login because her password was incorrect. Which was odd, because that was the problem with the previous customer, and she said it was correct. I reset the password and then she got in. All of this while WordFence was off.” – Wordfence cannot be involved in that strange behaviour when Wordfence is disabled.

Your PHP error logs may provide you with clues. You can also try to replicating it on a staging site, switch themes and deactivate other plugins to see if the theme or another plugin is causing this problem.

For the separate issue when you said, “Customer today using her iPhone couldn’t login, said her password was incorrect, changed it, logged in, then the contents of her cart disappeared. So I turned off WordFence. The cart came back and she could complete her order” – that is likely to be the Wordfence firewall seeing a request from one of your other addon WooCommerce plugins requests as being potentially malicious and blocking it. You can either whitelist these requests via the Learning Mode feature or from the Tools >> Live Traffic tool page. Both whitelisting methods are described in our instructions in the link below:

https://www.wordfence.com/help/firewall/learning-mode/

Actually, the firewall was turned off. I think the host suggested that because of the fact he had his own security in place and didn’t want the firewall on as a result.

I should mention besides yours, we don’t really have a lot of plugins running on this site. This is the current list:

Contact Form 7
Gutenberg Section Block
Hide Shipping Methods based on Shipping Class and Zone
NS8 Protect?
WooCommerce
WooCommerce Authorize.Net Gateway
WooCommerce Services
WooCommerce Shipment Tracking
WooCommerce Shipping Pro with Table Rate
WooCommerce Subscriptions
Yoast SEO

In case you’re wondering, NS8 is a service designed to capture credit card fraud, but I know these issues were occurring prior to that service being added.