{"id":19034032,"date":"2026-10-01T12:15:41","date_gmt":"2026-10-01T12:15:41","guid":{"rendered":"https:\/\/wordpress.org\/support\/topic\/severe-performance-issue-in-password-protection-module\/"},"modified":"2026-10-01T12:15:41","modified_gmt":"2026-10-01T12:15:41","slug":"severe-performance-issue-in-password-protection-module","status":"publish","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/severe-performance-issue-in-password-protection-module\/","title":{"rendered":"Severe performance issue in Password Protection module"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Hi,<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I\u2019m experiencing random severe latency on a WordPress website using ASE.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">During profiling, I found that some frontend requests can take around <strong>123 seconds<\/strong> to complete.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Example:<\/p>\n\n\n\n<ul>\n<li>Total request time: <strong>122,994 ms<\/strong><\/li>\n\n\n\n<li><code>wp-includes\/pluggable.php -&gt; wp_check_password()<\/code>: <strong>120,760 ms<\/strong><\/li>\n\n\n\n<li>Elementor: ~875 ms<\/li>\n\n\n\n<li>Database queries: ~150 ms<\/li>\n\n\n\n<li>cURL: ~230 ms<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">I searched the codebase for calls to <code>wp_check_password()<\/code> and found the frontend Password Protection module here:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>wp-content\/plugins\/admin-site-enhancements\/classes\/class-password-protection.php<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">around line 162.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The code appears to retrieve the <code>asenha_password_protection<\/code> cookie and use it as the hash parameter passed to <code>wp_check_password()<\/code>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A normal bcrypt benchmark on the same server gives:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>PASSWORD_BCRYPT cost 10: ~79 ms<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So the server itself does not appear to have a bcrypt performance issue.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This makes me suspect that a malformed or unusually expensive bcrypt hash stored in the <code>asenha_password_protection<\/code> cookie could cause <code>wp_check_password()<\/code> to consume a very large amount of CPU time.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The issue is intermittent, which would also be consistent with the request depending on the cookie value.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Disabling ASE Password Protection and replacing it with HTTP Basic Auth \/ <code>.htpasswd<\/code> appears to be a suitable workaround.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Could you please review whether the cookie value should be validated before it is passed to <code>wp_check_password()<\/code>?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In particular, it may be worth checking:<\/p>\n\n\n\n<ul>\n<li>that the hash has the expected format<\/li>\n\n\n\n<li>that the bcrypt cost is within an acceptable range<\/li>\n\n\n\n<li>that malformed\/unexpected cookie values are rejected before password verification<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">I can provide profiling screenshots and additional testing if needed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Thanks,<\/p>\n","protected":false},"template":"","class_list":["post-19034032","topic","type-topic","status-publish","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/19034032","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/19034032\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=19034032"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}