Does your password protection seem to be broken on your WordPress site?
If your WordPress site uses a page cache (like Litespeed Cache), and you have password-protected posts, disable the page cache on those posts. (The same is true for pages or any other post type.)
The password submission workflow, when your audience member puts the password into the form on the post, POSTs to https://example.com/wp-login.php?action=postpass with this payload:
redirect_to https://example.com/password-protected-page/
post_password super-secret-password
Submit Enter
wp-login.php sets a cookie with a name like wp-postpass_654afe7932 with a large random hex number in the name.
It then does a 302 redirect to the password-protected post. Then, in response to the redirect, the page cache does not serve the newly unveiled page to the the user. Instead, it serves that same form with the password prompt, so it looks like the password didn’t work. But, there’s no “wrong password” message, just the same page again. Very confusing. If several different users are trying to view the page, the confusion is even worse.
Litespeed Cache lets you disable caching for a post in that post’s editor panel. The control looks like this, with the Disable Cache slider set to the activated position.
