Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsThe WordPress message “Cookies are blocked or not supported by your browser” means WordPress could not write or read the cookie it needs to test login support—usually wordpress_test_cookie—or could not use its authentication cookie. It does not automatically mean that every cookie is disabled in your browser.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Work through the layers in order: test the browser, make the site URL and cookie scope consistent, verify HTTPS and wp-config.php, bypass caches, isolate plugins and themes, then have the host inspect proxy or server headers. The scope of the failure tells you where to start: one browser points to a local setting; every browser points to WordPress, caching, proxy, CDN, or hosting configuration.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What the error actually means
WordPress login depends on cookies for both its diagnostic check and the authenticated session. During the login flow, WordPress sets a temporary cookie named wordpress_test_cookie to probe whether the browser can accept cookies. The WordPress Developer Resources cookie documentation explains that if writing this cookie fails, WordPress displays “Cookies are blocked or not supported by your browser.”
A failure can occur at several points:
- The browser refuses the cookie because of a site-specific setting, privacy extension, blocked third-party context, or stale cookie data.
- The cookie is issued for a different hostname, path, or scheme than the page you are using.
- WordPress constants such as
COOKIE_DOMAIN,COOKIEPATH, orSITECOOKIEPATHdescribe the wrong scope. - HTTP and HTTPS are mixed, so a secure cookie is not returned to an HTTP page or a proxy reports the wrong scheme.
- A page cache, CDN, security plugin, or server filter removes, caches, or rewrites the response that contains
Set-Cookie.
That is why the same account can work in one browser and fail in another, or why the error can appear immediately after a migration, SSL change, domain mapping change, or plugin update.
Identify the failure scope before changing anything
Use a short, controlled test. Do not change several configuration layers at once; you need to know which change fixed the problem.
| What you observe | Most likely layer | Best first action |
|---|---|---|
| Only one browser or one computer fails | Browser cookie policy, stored cookies, or an extension | Allow cookies for the site, clear that domain’s data, and retry in a private window |
| Normal window fails but private window works | Extension or stale site data | Disable privacy and blocking extensions, then re-enable them individually |
| Every browser fails on one computer | Local network filtering or a site configuration issue | Test from another network and compare the exact URL |
| Every browser and device fails | WordPress URL, cookie constants, HTTPS, cache, CDN, plugin, or host | Continue with the WordPress and server-side checks below |
| The issue began after migration or changing domains | home/siteurl, domain mapping, or cookie scope |
Make hostname, path, and HTTP/HTTPS scheme identical |
| The issue began after a security or login plugin update | Plugin filtering or renamed-login rules | Disable the suspect plugin and test the standard login endpoint |
Record the exact address shown in the browser, including http or https, www or the apex hostname, and any subdirectory. Those details matter when WordPress decides where a cookie belongs.
Recommended Free Tools
1. Check browser cookie settings and extensions
Start with the browser because this is the safest layer to change and the quickest way to separate a local problem from a site problem.
Allow cookies for the affected site
Open the browser’s privacy or site-settings panel, find the affected hostname, and set cookies to allow (or at least allow first-party cookies) for that site. Browser labels differ by version, but the control is normally under Settings, Privacy or Security, Cookies, and Site data. If your organization manages the browser, an administrator policy may override this setting.
Clear only the site’s stored data
Delete cookies and site data for the WordPress hostname rather than wiping every saved login. Close all tabs for the site, reopen the login page, and try again. A cookie created before a domain, path, or HTTPS change can conflict with the new one.
Use a private window or a second browser
Open the login URL in a private or incognito window. This usually starts without the normal profile’s cookies and most extensions. If login works there, the server is probably able to set cookies; concentrate on the original browser’s data or add-ons. A second browser on the same device is a useful confirmation.
Disable blockers temporarily
Turn off ad blockers, tracker blockers, script-control tools, and privacy extensions for the site, then reload the login page. Security extensions can reject a cookie or prevent the response from completing even when ordinary browsing works. If the error disappears, restore extensions one at a time, testing after each re-enable. Keep the conflicting extension disabled for this site or add a narrowly scoped exception rather than disabling protection globally.
Check date, time, and managed policies
An incorrect system clock can make secure sessions appear invalid. Set the device to automatic date and time, then retry. On a managed computer, browser policies or endpoint security software can impose cookie restrictions that you cannot change; your administrator may need to allow the site.
2. Make the WordPress URL and the browser address identical
WordPress uses its configured home and siteurl values when generating links and cookie scope. The browser address must agree on all of these attributes:
- Hostname: for example,
www.example.comversusexample.com. - Path: a site installed at
/blogis not equivalent to one at the domain root. - Scheme:
httpandhttpsare different origins for cookie purposes. - Port, where a non-standard port is used.
Look for redirects that silently switch one of these values. A login page that starts on one host and posts to another can make the browser store the test cookie outside the page’s scope.
Check the values in the dashboard
If you can reach the dashboard through an existing session, open Settings → General and compare WordPress Address (URL) with Site Address (URL). Use the canonical hostname and scheme that visitors should use. Save only after checking that your web server and certificate support the chosen address; an incorrect change can make the dashboard inaccessible.
Check when the dashboard is unavailable
Ask the site administrator or host to inspect the home and siteurl values in the WordPress options table, or use the host’s database management tool. A migration may leave the old hostname in one value. Domain mapping and subdirectory installations require particular care because changing the path can invalidate existing cookies.
Follow redirects to one canonical URL
Enter the intended login address manually, then watch the address bar through every redirect. Resolve loops or switches between www and the apex domain before testing cookies again. Do not solve the symptom by adding a broad cookie domain; first make the site’s canonical URL unambiguous.
3. Inspect cookie-related settings in wp-config.php
Open wp-config.php through SFTP or your host’s file manager and make a backup before editing. Search for these definitions:
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
| Setting | What it controls | What to verify |
|---|---|---|
WP_HOME |
The public site address | It matches the canonical scheme, hostname, and path |
WP_SITEURL |
The address where WordPress core is installed | It is correct for the installation directory |
COOKIE_DOMAIN |
The host scope of WordPress cookies | It is absent unless a deliberate multisite or mapped-domain design requires it |
COOKIEPATH |
The URL path that receives cookies | It matches the installation path and is not an old subdirectory |
SITECOOKIEPATH |
The site-wide cookie path in relevant configurations | It is not overriding the current path |
Remove a stale or incorrect COOKIE_DOMAIN definition instead of copying a forum snippet. A cookie domain that worked for a subdomain or multisite network can prevent the main site from receiving the cookie. The correct value depends on the actual host and network layout.
Check for duplicate definitions as well. In wp-config.php, the last effective definition can override an earlier one, while a host or deployment script may inject values elsewhere. Keep a copy of the original file, make one controlled change, and test immediately.
4. Use HTTPS consistently from browser to origin
Mixed HTTP and HTTPS is a frequent cause after installing a certificate or placing WordPress behind a reverse proxy. A cookie marked secure is sent only over HTTPS. Conversely, if WordPress believes the request is HTTP while the browser is using HTTPS, it can generate redirects and cookie attributes that do not match the real connection.
Check every layer
- The login URL should use HTTPS and remain HTTPS through redirects.
- WordPress Address and Site Address should use the same HTTPS scheme.
- The reverse proxy or CDN must forward the original protocol correctly to the origin.
- Server redirect rules should not bounce requests between HTTP and HTTPS.
- The certificate must cover the exact hostname, including whether it uses
www.
After correcting the scheme, clear the affected browser cookies and purge caches. A browser may retain a cookie created under the previous scheme, while a cached redirect can continue sending users to the old one.
When a proxy terminates TLS
If HTTPS ends at a load balancer or CDN and the origin receives HTTP, WordPress needs the platform’s documented forwarded-protocol configuration so it can recognize the original secure request. Have the host verify this rather than adding arbitrary constants: an incorrect proxy rule can create redirect loops or mark the wrong cookies.
5. Bypass page caches and CDN caching for login
Login responses are user-specific and must not be served from a public cache. Exclude these paths and request types from page caching:
wp-login.php/wp-admin/- Requests that set or depend on authentication cookies
- Any custom login URL created by a security plugin
Clear the WordPress caching plugin, server cache, reverse-proxy cache, and CDN cache after changing URLs, SSL settings, or cookie rules. Purging only the browser is insufficient if an intermediary is still returning an old response.
Signs that a cache is involved
The error may appear for every browser, disappear briefly after a purge, or show a response that does not change when you add a harmless query string. A cached login page can omit the current Set-Cookie header or replay a response generated for another host.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What to ask the cache administrator
Request that they verify the login paths are bypassed, responses containing Set-Cookie are not stored as public pages, and cache keys include the correct hostname and scheme. Do not cache authenticated pages merely to improve speed; that can expose one user’s content to another.
6. Isolate plugins and the active theme
Security, login-renaming, cookie-consent, and optimization plugins can change headers, intercept login requests, or move the login endpoint. A theme can also emit output or alter login behavior.
Disable plugins without dashboard access
Use SFTP or the host file manager to rename the wp-content/plugins directory temporarily, or rename only the suspected plugin’s directory. This forces WordPress to deactivate it. Test the normal login URL, then restore the directory name and activate plugins individually to identify the conflict.
Prioritize plugins that:
- Rename or hide
wp-login.php. - Add firewall, bot-detection, or country rules.
- Rewrite cookies, headers, or cache behavior.
- Force a different login domain or HTTPS policy.
- Inject consent scripts that block storage before the login form runs.
Test the theme
If disabling plugins changes nothing, rename the active theme directory through SFTP or the host file manager. WordPress will fall back to an available default theme. If login then works, restore the theme and inspect its login hooks, custom redirects, and early output.
Re-enable safely
Once login works, restore components one at a time. Test in a private window after each activation, and keep a record of the first component that brings the error back. Update or replace that component only after confirming that its settings—not merely its presence—cause the failure.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Inspect the response and involve the host when every browser fails
If the error persists across browsers and devices after URL, HTTPS, cache, and plugin checks, the next evidence is in the HTTP response. A host or developer should inspect the login request and response headers for:
- A
Set-Cookieheader forwordpress_test_cookieand, after successful authentication, the WordPress authentication cookie. - A cookie domain or path that does not match the address in the browser.
SecureorSameSiteattributes that conflict with the way the site is loaded.- A reverse proxy or CDN stripping
Set-Cookie, caching the login response, or serving a response from another hostname. - Web-application firewall or server rules filtering the login request.
- Domain-mapping rules sending the request to a different WordPress installation.
Provide the host with the exact failing URL, the time of a failed attempt, whether another browser was tested, and whether the issue began after a migration, SSL change, or plugin update. Do not send passwords or session cookies. A header trace from a private test session is safer than exporting your normal browser profile.
What a healthy sequence looks like
- The login page loads from the canonical HTTPS hostname.
- The response can set
wordpress_test_cookiefor that host and path. - The browser returns the test cookie when the form is submitted.
- After valid credentials, WordPress sets authentication cookies for the same intended scope.
- The redirect to the dashboard remains on the canonical hostname and scheme.
A break at any one of these points identifies the layer to repair; repeatedly changing passwords will not fix a cookie-scope failure.
8. A controlled recovery sequence
Use this order when you need a practical checklist and want to minimize downtime:
- Copy the exact login URL and note its hostname, path, and scheme.
- Try a private window and a second browser.
- Allow cookies for the site and clear only that site’s stored data.
- Disable privacy, tracking, and security extensions for one test.
- Compare the browser address with WordPress
homeandsiteurl. - Review
WP_HOME,WP_SITEURL,COOKIE_DOMAIN,COOKIEPATH, andSITECOOKIEPATHinwp-config.php. - Make the entire path HTTPS and verify proxy protocol forwarding.
- Exclude login and administrative paths from every cache, then purge all cache layers.
- Disable plugins, especially login and security tools, and test; if necessary, switch the theme temporarily.
- If all clients still fail, have the host inspect
Set-Cookie, proxy/CDN behavior, domain mapping, and server filtering.
After each change, clear the affected site’s cookies and test in a private window. That prevents an old cookie or cached page from disguising the result.
Common scenarios and the fastest branch
“It works in one browser but not another”
Treat this as a browser-profile issue first. Clear the failing browser’s site data, test privately, and disable extensions. If the private window works, re-enable extensions individually. If both browsers fail only on one network, test from a different connection before changing WordPress.
“It broke immediately after moving the site”
Check the old and new hostnames, subdirectory paths, and HTTP/HTTPS values in home, siteurl, and wp-config.php. Purge every cache and remove obsolete cookie-domain definitions. Confirm that the new domain points to the intended WordPress installation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
“It broke after enabling SSL”
Verify that the browser, WordPress URLs, redirects, proxy protocol, and certificate all use the same HTTPS hostname. Clear cookies created before the change and purge cached redirects.
“It broke after installing a security plugin”
Temporarily disable the plugin, including any renamed-login feature, and test the standard endpoint. If that restores login, review its allowed paths, cookie or firewall settings, and cache exclusions before re-enabling it.
“Nobody can log in, but the public site works”
Focus on login-path caching, response headers, firewall rules, and host filtering. A public homepage can remain healthy while wp-login.php loses its Set-Cookie header or is served from cache.
Prevent the error from returning
- Choose one canonical hostname and HTTPS scheme, and redirect all alternatives to it.
- Keep
home,siteurl,WP_HOME, andWP_SITEURLaligned with the deployment. - Avoid setting
COOKIE_DOMAINunless the site’s documented network design requires it. - Exclude login, administration, and authenticated requests from page and CDN caches.
- Document any reverse-proxy forwarded-protocol setting used for TLS termination.
- After migrations or SSL changes, purge server and CDN caches and test a fresh private session.
- When adding a security or login plugin, test its login-renaming and cookie settings before enabling aggressive rules on a live site.
- Keep a rollback copy of
wp-config.phpand record which component was changed when a login issue appears.
The Bottom Line
Fix the layer that is preventing WordPress from setting or receiving its test cookie: browser settings for a one-browser failure; URL, HTTPS, cookie constants, and cache rules for a site-wide failure; and response-header or host investigation when every client fails.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
