Title: jrc67's Replies | WordPress.org

---

# jrc67

  [  ](https://wordpress.org/support/users/jrc67/)

 *   [Profile](https://wordpress.org/support/users/jrc67/)
 *   [Topics Started](https://wordpress.org/support/users/jrc67/topics/)
 *   [Replies Created](https://wordpress.org/support/users/jrc67/replies/)
 *   [Reviews Written](https://wordpress.org/support/users/jrc67/reviews/)
 *   [Topics Replied To](https://wordpress.org/support/users/jrc67/replied-to/)
 *   [Engagements](https://wordpress.org/support/users/jrc67/engagements/)
 *   [Favorites](https://wordpress.org/support/users/jrc67/favorites/)

 Search replies:

## Forum Replies Created

Viewing 3 replies - 1 through 3 (of 3 total)

 *   Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/)
    In
   reply to: [[Simple CAPTCHA with Cloudflare Turnstile] WooCommerce Login: Missing Turnstile validation logged as wrong password (v1.42.](https://wordpress.org/support/topic/woocommerce-login-missing-turnstile-validation-logged-as-wrong-password-v1-42/)
 *  Thread Starter [jrc67](https://wordpress.org/support/users/jrc67/)
 * (@jrc67)
 * [1 week, 5 days ago](https://wordpress.org/support/topic/woocommerce-login-missing-turnstile-validation-logged-as-wrong-password-v1-42/#post-18976488)
 * **Additional testing results:**
 * I have narrowed this down further.
    - Chrome (desktop): **Works normally**
    - Firefox (desktop): **Works normally**
    - Safari on iPhone/iPad: **Works normally**
    - **Safari 26.5.2 on macOS Tahoe:** requires manually clicking the Turnstile
      checkbox every time. It no longer automatically verifies trusted sessions 
      as it did before the recent updates.
 * This behavior is only occurring on desktop Safari.
 * Combined with the authentication issue I reported above (correct credentials 
   being recorded as a failed password when Turnstile is not completed), this appears
   to point to a Safari-specific issue rather than a Cloudflare widget configuration
   issue.
 *   Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/)
    In
   reply to: [[Simple CAPTCHA with Cloudflare Turnstile] WooCommerce Login: Missing Turnstile validation logged as wrong password (v1.42.](https://wordpress.org/support/topic/woocommerce-login-missing-turnstile-validation-logged-as-wrong-password-v1-42/)
 *  Thread Starter [jrc67](https://wordpress.org/support/users/jrc67/)
 * (@jrc67)
 * [1 week, 5 days ago](https://wordpress.org/support/topic/woocommerce-login-missing-turnstile-validation-logged-as-wrong-password-v1-42/#post-18976452)
 * I have additional evidence that may help narrow this down.
 * WP Activity Log records two events from the same IP address, same browser, and
   the same account approximately 23 seconds apart.
 * **Attempt 1**
    - Correct username
    - Correct password
    - Turnstile not completed
    - Login blocked
    - Logged as **“Failed login attempt – wrong password”**
    - The log entry also displays the user as **“Deleted user”**, even though the
      event contains:
       * CurrentUserID: 73016
       * CurrentUserRoles: customer
 * **Attempt 2 (23 seconds later)**
    - Same username
    - Same password
    - Same IP
    - Same browser
    - Turnstile completed
    - Login succeeds immediately as User ID 73016.
 * The credentials are clearly valid because the only difference between the two
   attempts is whether Turnstile was completed.
 * It appears that when Turnstile validation fails, the plugin is returning a generic
   WordPress authentication failure (“wrong password”) instead of a Turnstile validation
   failure. This causes security plugins such as WP Activity Log and Limit Login
   Attempts Reloaded to treat the event as a genuine failed password attempt.
 * I have screenshots of both log entries if you would like me to provide them another
   way.
 *   Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/)
    In
   reply to: [[Simple CAPTCHA with Cloudflare Turnstile] Turnstile token consumed by Global Payments GPAPI two-phase checkout](https://wordpress.org/support/topic/turnstile-token-consumed-by-global-payments-gpapi-two-phase-checkout/)
 *  [jrc67](https://wordpress.org/support/users/jrc67/)
 * (@jrc67)
 * [1 week, 5 days ago](https://wordpress.org/support/topic/turnstile-token-consumed-by-global-payments-gpapi-two-phase-checkout/#post-18976422)
 * Hi Elliot,
 * I’ve opened a separate topic for the WooCommerce login issue so we can keep the
   discussions separate.
    -  This reply was modified 1 week, 5 days ago by [jrc67](https://wordpress.org/support/users/jrc67/).

Viewing 3 replies - 1 through 3 (of 3 total)