2

I protect the wp-login.php file via my .htaccess file:

<Files wp-login.php>
AuthName "Admin-Bereich"
AuthType Basic
AuthUserFile /*path*/htdocs/.htpasswd
require valid-user
</Files>

Now when I call my website with /wp-admin/, it asks for username and password which I specified in the .htpasswd file. After I have entered these correctly, I get to the WordPress login. There I enter my WordPress credentials, i.e. username and password. And even though I enter everything correctly here as well, after logging in I am asked AGAIN for the username and password which I specified in the .htpasswd file. Why? Only after that I am in the WordPress backend and can work normally.

But normally it should be enough that I enter them once when calling the /wp-admin/ page, then the WordPress login and done? But I have to enter the .htaccess credentials twice.

What can be the reason for this?

I only use this one .htaccess file which is in the htdocs folder. There is NO other .htaccess in the wp-admin folder.

2
  • What browser are you using? Have you tried different browsers? I just wonder if this is perhaps browser specific? (It is dependent on the browser sending the Authorization header as part of the HTTP request.)
    – MrWhite
    Jan 13, 2023 at 17:34
  • I am using Chrome. And yes, it does NOT happen with Firefox and does NOT happen with Safari on iOS (in both cases you just enter the username and password for htaccess once and the login credentials for Wordpress. But it does not work with Opera, not with Chrome, not with Edge.
    – dajana.s
    Jan 13, 2023 at 22:21

3 Answers 3

2

I think the reason can be much simpler than in the discussion and comments: Check that the URL is exactly correct and the same. Sometimes, if you have set a non-www URL in WP but open it with a www, or if you have set the https URL in WP, but request the site without https, the redirect that happens after the first contact can initialize a second auth request, because the URL changed.

1
  • Not the case. Always with www and always https. And it worked for years (nearly a decade without any problems).
    – dajana.s
    Jan 15, 2023 at 22:13
0

This would happen if a request is made to wp-login.php that is missing the Authorization header (that contains the encoded username/password credentials that the browser saved previously).

My guess is that there is an "AJAX" POST request when the WordPress login form is submitted back to the server that omits this Authorization header. Although whether the Authorization header is sent or not is entirely dependent on the browser.

It is also possible that your initial request (to /wp-admin/) and the subsequent that triggers a 2nd password prompt are to different URLs (so the browser legitimately does not send the Authorization header). However, both requests end up calling wp-login.php on the server. (Obviously /wp-admin/ is not calling wp-login.php directly.)

You can examine the HTTP requests in the browser... look for the "401 Unauthorized" response and the corresponding HTTP request that triggered this response. This should give some clues as to what/why this is happening.

7
  • When I open examplewebsite.com/wp-admin, I immediately see in the browser: examplewebsite.com/wp-login.php?redirect_to=https%3A%2F%2Fwww.examplewebsite.com%2Fwp-admin%2F&reauth=1 and I am asked for username and password for the htaccess protected area. I enter the correct data and this URL is still in the browser. I see the login page and enter my data to login wordpress correctly. Now it says examplewebsite.com/wp-login.php in the browser and I am again asked for username and password of htaccess. But why! What can I do about it?
    – dajana.s
    Jan 13, 2023 at 22:09
  • When I open the console from Chrome, the following happens in the following order. After opening examplewebsite.com/wp-admin/ the prompt for username and password appears and it says "Failed to load resource: the server responded with a status of 401 ()". I enter htaccess username and password correctly. Then the login page appears and in the console: "GET examplewebsite.com/wp-json/wp/v2/users/… 401 (Unauthorized)" and "{code: 'rest_not_logged_in', message: 'You are not logged in.', data: {...}}" with "data: {status: 401}".
    – dajana.s
    Jan 13, 2023 at 22:16
  • I enter the correct data to login to wordpress. Again the same query of username and password of the htaccess appears with URL examplewebsite.com/wp-login.php and then in the console it says: "Failed to load resource: the server responded with a status of 401 ()". I don't understand this. It was not like this before. Did this happen due to a recent wordpress update?
    – dajana.s
    Jan 13, 2023 at 22:18
  • This is how I protect the wp-login.php in htaccess: <Files wp-login.php> AuthName "Admin-Bereich" AuthType Basic AuthUserFile /individualpath/www/www.examplewebsite.com/htdocs/.htpasswd require valid-user </Files> (of course with single lines, which I can't show here)
    – dajana.s
    Jan 13, 2023 at 22:23
  • @dajana.s Please update your question with this additional information (using backticks and indentation to retain formatting). Unformatted data dumps in comments is hard to read and tends to omit important information. (You've already included the relevant .htaccess directives in the question, so this does not need to be repeated - assuming there are no other directives that might be conflicting in the .htaccess file?)
    – MrWhite
    Jan 14, 2023 at 10:46
0

It is likely that you are being prompted to enter your login information twice because your .htaccess file is configured to require authentication for both the directory that it is in, as well as any subdirectories within it. You can check this by reviewing the contents of your .htaccess file and looking for any lines that begin with "AuthType" or "AuthUserFile." If you only want to prompt for login information once, you can modify the .htaccess file to only require authentication for the top-level directory.

1
  • Hello Morhad, thank you very much for your answer. In the htaccess there is only the entry mentioned in my first post with AuthName "Admin Area". I deliberately searched for "AuthType" and "AuthUserFile" after your tip and that was the only match.
    – dajana.s
    Jan 14, 2023 at 11:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.