This is probably a bug. I’v tried WordPress with Nginx and with Apache. I’ve also tried it with Cloudflare and without it. I always get the same result. WordPress recognizes the protected page by adding the word “protected” before the title but it shoes it to everyone regardless of everything I did.
