password-protected pages break

[dematth-png]

Impacted plugin

Super Cache

Quick summary

WordPress pages that are password protected never succeed to show the content.

Steps to reproduce

In WordPress a page can be password protected.

The page first shows only a password prompt. When that is given, the actual content of the page appears.

This seems to be broken in WP Super Cache. Submitting the password produces only the password prompt again.

Including the URL of the page in the Rejected URL Strings setting fails to fix it. Even deleting the cache fails to fix it.

An example page is https://aacny.org/wordpress/tsl/. The correct password is TSL.

Site owner impact

Fewer than 20% of the total website/platform users

Severity

Moderate

What other impact(s) does this issue have?

No revenue impact

If a workaround is available, please outline it here.

None that I know of.

Platform (Simple and/or Atomic)

Simple

[donnchawp]

This was generated by AI during triage.

Triage Notes

What we've established so far:

• WP Super Cache handles post-password-protected pages correctly. Verified on a reference site running WPSC: the password prompt is cached for anonymous visitors, but submitting the password sets the wp-postpass_ cookie, which WPSC uses to vary the cache key (wp_cache_get_cookies_values()) and, in mod_rewrite mode, to bypass the static file entirely (the rewrite rule excludes any request carrying a wp-postpass_ cookie). The unlocked content then displays.
• Your page's HTTP responses carry an Age header, an x-request-id header, and a request_id cookie, and none of WP Super Cache's signatures (no Cached page generated by WP-Super-Cache comment). That pattern indicates a separate caching layer in front of the site — a CDN, reverse proxy, or host-level page cache — which appears to be caching the password-required response (despite its no-store, private headers) and serving the prompt regardless of the postpass cookie.

What we still need from you (@dematth-png):

1. Is there a CDN, reverse proxy, or host-provided page cache in front of the site? Who is the host? (The Age / request_id headers suggest one.)
2. Does the page work correctly if you fully disable WP Super Cache caching? If it still breaks with WPSC off, the cause is upstream of the plugin.
3. WP Super Cache version, WordPress version, and the configured Cache Delivery Method (Simple/PHP vs Expert/mod_rewrite)?
4. With the host/CDN cache bypassed (or in an incognito session right after entering the password), does the content display?

[dematth-png]

Thanks for the perspicacious triage, @donnchawp.

1. There does not appear to be a CDN or host-provided cache, since the site is very slow without WPSC. The host is Network Solutions.
2. The page does work correctly when I deactivate the WPSC plugin.
3. WPSC version 3.1.0, WordPress 6.9.4, cache delivery method Simple
4. I don't know how to bypass the host/CDN cache, but the incognito session still fails to display the content.
   I have deactivated WPSC and will leave it that way for 24 hours, so you can test that configuration.

• Dave

[donnchawp]

I understand that there is something up with password protected pages on your site but I really think it's something to do with your site, and not a general WPSC issue.
Enable caching again and enable the debug log. Then look at the log when you load the page. You should see it generate the page there.
Look at the page source and you'll see WP Super Cache comments at the end, something like: "Cached page generated by WP-Super-Cache".
When you enter the password, the debug log should show the page being generated and when you reload it again it should say "wp_cache_get_cookies_values: Login/postpass cookie detected".

[dematth-png]

Nothing at all appears in wp-content/debug.log when I load the page.
(There is a lot of other stuff in the file from the Events Calendar and from Solid Backups, but when I deactivate those plugins, nothing appears in the log.)

[dematth-png]

Oh, you mean the WPSC's own debug log!
I don't see the page source, just WPSC comments. There are several lines of
03:03:02 1817020 /wordpress/tsl/ wp_cache_get_cookies_values: return:
There are some with the desired value but they are mainly for admin-ajax.php,
03:03:23 3889439 /wordpress/wp-admin/admin-ajax.php wp_cache_get_cookies_values: Login/postpass cookie detected
None for the wordpress/tsl page.