More fixes

WordPress says "Cookies are blocked or not supported by your browser"

You type the right username and password, press Log In, and WordPress answers "ERROR: Cookies are blocked or not supported by your browser. You must enable cookies to use WordPress." Your browser usually allows cookies fine. WordPress sets a small test cookie when it shows the login form, and the error means that cookie did not come back with your login. Here is how to tell why, and the fix for each case.

First, rule out the browser

Open a private window in a different browser and log in there. If it works, clear the cookies for your site in the first browser (or turn off the extension that blocks them) and you are done. If it fails in every browser, the cause is on the site, and one of the cases below applies.

Find out which case it is

1. Compare the address bar with Settings > General. If you log in at harborbakery.example but "WordPress Address" says https://www.harborbakery.example (or the other way round, or http against https), the cookie is set for one address and the login is checked on the other.
2. Open wp-config.php and search for COOKIE_DOMAIN, COOKIEPATH or WP_HOME. A leftover line from an old domain, a staging copy or a multisite setup sends the cookie to a host your browser never visits.
3. Look at the login page's response headers (F12, Network, reload wp-login.php, click the first request). No Set-Cookie: wordpress_test_cookie line, or an x-cache: HIT / cf-cache-status: HIT line, means a cache is serving a stored copy of the login page without the cookie.
4. Turn on WP_DEBUG_LOG and try again. A "Cannot modify header information - headers already sent" line means a plugin, theme or a stray space before <?php printed output early, so PHP could not send the cookie.
5. Did it start after installing a security or login-URL plugin, or a CDN? Note which one; it narrows the fix to that one setting.

The fixes, by case

1. www or https mismatch: make "WordPress Address" and "Site Address" the same address you actually use, including https and www. If you cannot reach Settings, put define('WP_HOME','https://harborbakery.example'); and define('WP_SITEURL','https://harborbakery.example'); in wp-config.php with your real address, and redirect the other form to it at the host or CDN.
2. Wrong COOKIE_DOMAIN: delete the line, or set it to your current domain. On a single site it is almost never needed. On a multisite with mapped domains, define('COOKIE_DOMAIN', $_SERVER['HTTP_HOST']); is the usual fix.
3. Cached login page: exclude /wp-login.php and /wp-admin/ from the caching plugin and from the CDN (a Cloudflare cache rule "bypass" for those paths), then purge the cache.
4. Headers already sent: the log line names the file and line that printed early. Remove the blank line or space before <?php (or after a closing ?>), re-save the file without a BOM, or update or disable the plugin it names.
5. Security plugin or custom login URL: rename that plugin's folder in wp-content/plugins over FTP or the host's file manager, log in, then set it back up with the login address it expects.
6. Login test cookie only: as a last resort, a few hosts' firewalls strip cookies whose names start with wordpress_. Ask the host to allow them rather than patching WordPress.

What you see, what it means, what it needs

What not to do

• Do not edit wp-login.php to remove the cookie check. It comes back with the next update and hides the real fault.
• Do not change the address in Settings to one that does not load. You will lock yourself out; use the two wp-config lines instead.
• Do not reset your password over and over. The password is fine; the cookie is what fails.
• Keep a copy of wp-config.php before editing it, so every change can be undone.

Most cases are an address mismatch or a cached login page. If you still cannot log in, that is what the box below is for. Related: Login page keeps reloading, "Cannot modify header information", Too many redirects, Lost admin access.