I finally figured this out. This was only a problem when the customer logged in through the account page or the checkout page. When I cleared my cookies and then logged in through wp-login.php, I didn’t have this issue.
WooCommerce does some interesting things with login cookies and nonces, which I assume allows them to use WordPress’ user system without giving a basic customer full subscriber access.
Ultimately I needed to remove this code from wp-config.php:
define( 'ADMIN_COOKIE_PATH', '/' );
define( 'COOKIE_DOMAIN', '' );
define( 'COOKIEPATH', '' );
define( 'SITECOOKIEPATH', '' );
I believe I had added that to fix a login redirect loop, which occurred after switching my site to Cloudflare Flexible SSL. I had also added this to wp-config.php to accommodate Flexible SSL, as referenced here and here:
define( 'FORCE_SSL_ADMIN', true );
if ( strpos( $_SERVER['HTTP_X_FORWARDED_PROTO'], 'https' ) !== false ) {
$_SERVER['HTTPS'] = 'on';
}
I eventually found that WooCommerce is not compatible with Cloudflare Flexible SSL, as mentioned at the bottom of their SSL FAQ page.
I ended up installing a free SSL certificate on my server using Let’s Encrypt, and switched Cloudflare’s setting to “Full (strict)”. Once I had full SSL working, I was able to remove the above lines of code from wp-config.php.
It’s possible that removing the top four “cookie” lines would have solved the issue and I could have continued using Flexible SSL. However, I had installed the SSL cert before discovering that wp-config.php was the issue. Regardless, setting up the full SSL cert is what I should have done in the first place. As Cloudflare says, “Only choose Flexible if your origin webserver cannot accept secure (HTTPS) connections.”
Finally, in debugging this issue, I came across the wc_session_use_secure_cookie filter, which is applied when the login cookie gets set and destroyed in class-wc-session-handler.php. My site seems to work fine no matter which way it’s set, but I added it to functions.php for good measure:
add_filter( 'wc_session_use_secure_cookie', '__return_true' );
