Why do I have to enter basic authentication credentials twice for WordPress with .htaccess?

Question

I protect the wp-login.php file via my .htaccess file:

<Files wp-login.php>
AuthName "Admin-Bereich"
AuthType Basic
AuthUserFile /*path*/htdocs/.htpasswd
require valid-user
</Files>

Now when I call my website with /wp-admin/, it asks for username and password which I specified in the .htpasswd file. After I have entered these correctly, I get to the WordPress login. There I enter my WordPress credentials, i.e. username and password. And even though I enter everything correctly here as well, after logging in I am asked AGAIN for the username and password which I specified in the .htpasswd file. Why? Only after that I am in the WordPress backend and can work normally.

But normally it should be enough that I enter them once when calling the /wp-admin/ page, then the WordPress login and done? But I have to enter the .htaccess credentials twice.

What can be the reason for this?

I only use this one .htaccess file which is in the htdocs folder. There is NO other .htaccess in the wp-admin folder.

Answer 1

I think the reason can be much simpler than in the discussion and comments: Check that the URL is exactly correct and the same. Sometimes, if you have set a non-www URL in WP but open it with a www, or if you have set the https URL in WP, but request the site without https, the redirect that happens after the first contact can initialize a second auth request, because the URL changed.

Answer 2

This would happen if a request is made to wp-login.php that is missing the Authorization header (that contains the encoded username/password credentials that the browser saved previously).

My guess is that there is an "AJAX" POST request when the WordPress login form is submitted back to the server that omits this Authorization header. Although whether the Authorization header is sent or not is entirely dependent on the browser.

It is also possible that your initial request (to /wp-admin/) and the subsequent that triggers a 2nd password prompt are to different URLs (so the browser legitimately does not send the Authorization header). However, both requests end up calling wp-login.php on the server. (Obviously /wp-admin/ is not calling wp-login.php directly.)

You can examine the HTTP requests in the browser... look for the "401 Unauthorized" response and the corresponding HTTP request that triggered this response. This should give some clues as to what/why this is happening.

Answer 3

It is likely that you are being prompted to enter your login information twice because your .htaccess file is configured to require authentication for both the directory that it is in, as well as any subdirectories within it. You can check this by reviewing the contents of your .htaccess file and looking for any lines that begin with "AuthType" or "AuthUserFile." If you only want to prompt for login information once, you can modify the .htaccess file to only require authentication for the top-level directory.