How to Fix “Cookies Are Blocked or Not Supported by Your Browser” in WordPress After Setting Up Cloudflare

How to Fix “Cookies Are Blocked or Not Supported by Your Browser” in WordPress After Setting Up Cloudflare

WordPress login problems can be frustrating, especially when your website works until you connect it to Cloudflare. You enter your username and password, click Log In, and WordPress displays:

Error: Cookies are blocked or not supported by your browser. You must enable cookies to use WordPress.

The message points to browser cookies, but the browser isn’t always responsible. WordPress might fail to set or validate its login cookies because of inconsistent URLs, incorrect HTTPS detection, caching rules, plugin conflicts, or server configuration.

This guide explains how to identify the cause and restore access without making unnecessary changes.

Why WordPress Needs Cookies

WordPress uses a test cookie on its login page and authentication cookies after login. These cookies help it recognize your browser and maintain your session. If they are missing, rejected, or scoped to the wrong domain or path, the login process can fail even when your browser allows cookies.

1. Check Cloudflare SSL/TLS Settings

In Cloudflare, open SSL/TLS → Overview and inspect the encryption mode. Full (strict) is the preferred mode when your origin server has a valid, compatible TLS certificate. It encrypts the connection to the origin and validates its certificate.

Avoid using Flexible as a permanent WordPress configuration: the visitor-to-Cloudflare connection may be HTTPS while Cloudflare communicates with the origin over HTTP, which can complicate redirects and HTTPS detection.

Important: Do not switch to Full (strict) until you confirm the origin certificate is valid, or you could cause an SSL error.

2. Confirm WordPress URLs

Your WordPress Address and Site Address should match your intended domain and HTTPS configuration. For a typical installation using a non-www domain, both may be:

siteurl: https://example.com
home:    https://example.com

If you can access WordPress, check Settings → General. Otherwise, use phpMyAdmin to inspect siteurl and home in your options table (often wp_options, though the prefix can vary).

Do not blindly make the values identical if WordPress is intentionally installed in a separate subdirectory.

3. Check HTTPS Detection Behind Cloudflare

WordPress must recognize when a visitor is using HTTPS. Some reverse-proxy setups forward requests in a way that makes WordPress believe they are HTTP.

If your server configuration does not already handle HTTPS detection correctly, this conditional example can be placed in wp-config.php before WordPress loads:

if (isset($_SERVER['HTTP_CF_VISITOR'])) {
    $visitor = json_decode($_SERVER['HTTP_CF_VISITOR'], true);

    if (
        is_array($visitor) &&
        isset($visitor['scheme']) &&
        $visitor['scheme'] === 'https'
    ) {
        $_SERVER['HTTPS'] = 'on';
    }
}

Security note: Trust proxy headers only when your origin accepts requests from trusted proxies. Otherwise, clients may spoof these headers. Confirm your hosting setup before adding this code.

For an admin dashboard that should always use HTTPS, you may also verify whether this setting is already present:

define('FORCE_SSL_ADMIN', true);

This is not a universal cookie fix; avoid duplicating an existing definition.

READ ALSO: Getting the best with Classic Editor – WordPress

4. Bypass Caching for Login and Admin Pages

Open Cloudflare → Rules → Cache Rules. WordPress login and administration pages should not be served from shared cache.

These paths should bypass caching:

/wp-login.php
/wp-admin/*

A Cloudflare rule expression can look like this:

(http.request.uri.path eq "/wp-login.php") or
(starts_with(http.request.uri.path, "/wp-admin/"))

Set the matching cache rule to Bypass cache. Review WordPress caching plugins and any server-side caching configuration too.

5. Inspect Cookie Constants in wp-config.php

Open wp-config.php and search for:

COOKIE_DOMAIN
COOKIEPATH
SITECOOKIEPATH
ADMIN_COOKIE_PATH

WordPress normally calculates cookie paths automatically. Incorrect custom values can make the browser reject cookies or keep them away from the login page.

Back up the file before changing existing definitions. Do not copy cookie constants from unrelated tutorials without understanding your domain and installation structure.

6. Test for Plugin Conflicts

Security, caching, login customization, and authentication plugins can interfere with login behavior.

If you cannot enter wp-admin, use your host’s File Manager or SSH to rename:

wp-content/plugins

to:

wp-content/plugins-disabled

Then try logging in. If login succeeds, an ordinary plugin may be responsible. Restore the folder name and test plugins individually.

This test does not disable must-use plugins in wp-content/mu-plugins. It may also temporarily interrupt plugin-powered site features.

7. Clear Stored Cookies and Cache

Delete cookies and site data for your WordPress domain in the browser. Reopen the login page in a fresh session:

https://example.com/wp-login.php

You can also purge relevant Cloudflare cached content. A Cloudflare cache purge does not remove cookies stored in the browser.

If the login works in a private window but not in your normal browser, inspect browser extensions, old cookies, and privacy settings.

8. Isolate Cloudflare from the Origin Server

For a controlled test, temporarily pause Cloudflare’s proxy service and try reaching your WordPress origin directly, provided the origin supports HTTPS and you understand the security implications.

If login works without Cloudflare but fails when Cloudflare is enabled, investigate Cloudflare rules, Workers, redirects, security challenges, and proxy settings.

If it fails both ways, focus on WordPress, the origin server, plugins, and the browser.

Caution: Bypassing Cloudflare may expose the origin IP and remove protections temporarily. Restore the proxy after testing.

9. Inspect Cookies in Browser Developer Tools

In Chrome or Edge, press F12, open Network, enable Preserve log, and submit the login form.

Inspect requests to wp-login.php and look for the Set-Cookie response header. Check whether the browser reports that a cookie was blocked and why. Pay attention to its domain, path, and Secure attributes.

This helps distinguish a cookie that was never issued from one that was issued but rejected.

10. Check Server Logs and Custom Code

If none of the previous checks identify the problem, inspect PHP and web-server error logs, redirect behavior, and custom authentication code.

Checkwp-config.php, theme functions.phpmust-use plugins, and any code that sends output before WordPress can set HTTP headers. Do not disable security protections permanently just to restore login access.

Conclusion

A WordPress cookie error after setting up Cloudflare does not automatically mean the browser is blocking cookies. The underlying problem may involve HTTPS detection, mismatched URLs, caching, or plugins.

Test one change at a time, keep backups, and compare behavior with and without Cloudflare when it is safe to do so. This makes it easier to identify the actual cause and fix it without introducing additional problems.

Frequently Asked Questions

Can Cloudflare cause WordPress cookie errors?

Yes. Incorrect SSL settings, proxy behavior, caching, or redirects can contribute to authentication problems, though Cloudflare is not always the cause.

Will clearing browser cookies fix the error?

Sometimes. It can remove stale cookies but cannot repair incorrect WordPress or server configuration.

Should I permanently disable Cloudflare?

No. A temporary diagnostic bypass may help identify the problem, but restore appropriate security protections afterward.

Does Full (strict) fix every WordPress cookie error?

No. It validates the origin TLS certificate, but WordPress still needs correct HTTPS detection and authentication settings.

References

• WordPress Cookies Documentation
• Cloudflare Full (strict) SSL Documentation

Author: Zazasco

Am a professional with more than 5 years of experience in Graphic designing, Content Creation, Web/Mobile Development, Animation, Vfx, Photo/Videographer, Branding. Am so much passionate about what I do and always researching to improve myself to meet up with trends and demands, I love teaching and also open to learning new skills. For more info. About me send me a message indicating your questions and get a reply from me.