jrc67
Forum Replies Created
-
Additional testing results:
I have narrowed this down further.
- Chrome (desktop): Works normally
- Firefox (desktop): Works normally
- Safari on iPhone/iPad: Works normally
- Safari 26.5.2 on macOS Tahoe: requires manually clicking the Turnstile checkbox every time. It no longer automatically verifies trusted sessions as it did before the recent updates.
This behavior is only occurring on desktop Safari.
Combined with the authentication issue I reported above (correct credentials being recorded as a failed password when Turnstile is not completed), this appears to point to a Safari-specific issue rather than a Cloudflare widget configuration issue.
I have additional evidence that may help narrow this down.
WP Activity Log records two events from the same IP address, same browser, and the same account approximately 23 seconds apart.
Attempt 1
- Correct username
- Correct password
- Turnstile not completed
- Login blocked
- Logged as “Failed login attempt – wrong password”
- The log entry also displays the user as “Deleted user”, even though the event contains:
- CurrentUserID: 73016
- CurrentUserRoles: customer
Attempt 2 (23 seconds later)
- Same username
- Same password
- Same IP
- Same browser
- Turnstile completed
- Login succeeds immediately as User ID 73016.
The credentials are clearly valid because the only difference between the two attempts is whether Turnstile was completed.
It appears that when Turnstile validation fails, the plugin is returning a generic WordPress authentication failure (“wrong password”) instead of a Turnstile validation failure. This causes security plugins such as WP Activity Log and Limit Login Attempts Reloaded to treat the event as a genuine failed password attempt.
I have screenshots of both log entries if you would like me to provide them another way.
Hi Elliot,
I’ve opened a separate topic for the WooCommerce login issue so we can keep the discussions separate.
- This reply was modified 1 week, 5 days ago by jrc67.