WordPress admin users randomly logged out when AIOS is active

  • natalyn

    (@natalyn)


    3 days ago

    Hi,

    We’ve recently started experiencing an issue where logged-in WordPress admin users are unexpectedly logged out while working in the dashboard. The issue occurs particularly often when opening or working with the Elementor editor.

    During troubleshooting, we found that the issue stops when All-In-One Security (AIOS) is deactivated. After reactivating the plugin, the logout behavior returns.

    When the issue occurs, we are seeing the following:

    rest_cookie_invalid_nonce
    wp-auth-check: false

    It appears that WordPress no longer considers the authentication session valid at that point.

    We have been using AIOS on this website for a long time and have not experienced this behavior until recently. We also cannot keep the plugin deactivated for an extended period, so we would like to identify the actual cause rather than use deactivation as a workaround.

    Could you please advise what AIOS settings, logs, or functionality we should check to determine what is causing the sessions to become invalid?

    Please let us know if there is any additional information, logs, or configuration details we can provide to help troubleshoot this.

    Thank you!

Viewing 1 replies (of 1 total)
  • Plugin Support hjogiupdraftplus

    (@hjogiupdraftplus)

    2 days, 21 hours ago

    Hi @natalyn

    The message wp-auth-check: false usually means that WordPress no longer considers the user to be logged in. As a result, you may also see the rest_cookie_invalid_nonce error because the login session or security token is no longer valid.

    Could you please check a few AIOS settings?

    First, go to AIOS → User Security and see if Force Logout is enabled. If it is, please disable it temporarily and test again.

    Next, go to AIOS → Brute Force. If Rename Login Page or Cookie-Based Brute Force Prevention is enabled, please disable each feature temporarily and test again.

    Finally, go to AIOS → Firewall → PHP Rules → WP REST API. If Disallow Unauthorized REST Requests is enabled, please make sure all Elementor REST API routes have been added to the allowlist. As a test, you can also temporarily disable this option and check whether the issue still occurs.

    If the problem continues, please let us know which of these features were enabled and whether disabling any of them made a difference. We’ll then continue investigating.

    Regards

Viewing 1 replies (of 1 total)

You must be logged in to reply to this topic.