Staging sites often use HTTP Basic Authentication at a CDN, reverse proxy, load balancer, or web server. WordPress loopback requests may include credentials, follow a redirect that drops Authorization, resolve to another address, or reach PHP without the header because the server does not pass it through. Adding the entire origin to an allowlist can hide the broken hop and expose staging to the internet.
Use this when Site Health, WP-Cron, REST, scheduled jobs, plugin scans, or cache preload report loopback 401 or 403 on a Basic Auth protected WordPress site.
Quick answer
Record the exact loopback URL, method, resolved address, Host, SNI, status chain, WWW-Authenticate header, request ID, and UTC time. Reproduce from the server with and without credentials, redirects disabled, IPv4 forced, IPv6 forced, and the canonical host. Check CDN, proxy, load balancer, web server, and PHP logs for the same request ID. Identify whether Authorization was absent, stripped on redirect, consumed upstream, not forwarded to PHP, or sent to the wrong origin. Fix the narrow hop or allow only authenticated self-requests with another controlled signal.
Test scenarios to run
Run the same controlled fixture across these branches. Write down the expected result before testing so a surprising response is easy to identify.
| Scenario | Fixture | Expected result |
|---|
| Direct canonical | Correct Basic Auth | 200 expected body |
| Redirect | HTTP to HTTPS | Header policy documented |
| IPv6 | AAAA origin | Same auth and certificate |
| External unauth | Public client | 401 challenge remains |
Diagnostic table
Use this table to connect the observed behavior to evidence and a verification step.
| Action | Evidence | Verification |
|---|
| Capture the exact loopback contract | Capture the WordPress loopback URL, hook or feature, method, timeout, redirect count, DNS answers, Host, SNI, status, body fingerprint, and error text. | The WordPress feature receives 200 with the expected body, not a login or challenge page. |
| Trace every network hop | Send canary requests with no credentials, correct credentials, wrong credentials, redirects disabled, IPv4, IPv6, localhost, origin address, and canonical hostname. | Authorization handling is consistent across CDN, proxy, server, PHP, IPv4, IPv6, and redirects. |
| Compare redirects and address families | Join CDN, WAF, proxy, load balancer, web server, PHP, WordPress HTTP API, cron, and plugin logs by request ID and timestamp. | External unauthenticated requests still receive the intended protection. |
| Repair the narrow header boundary | Check whether Authorization is consumed by the edge, removed during a scheme or host redirect, or omitted from the PHP server variables. | Temporary canary credentials, bypasses, and verbose logs are removed. |
What to check first
- Capture the WordPress loopback URL, hook or feature, method, timeout, redirect count, DNS answers, Host, SNI, status, body fingerprint, and error text.
- Send canary requests with no credentials, correct credentials, wrong credentials, redirects disabled, IPv4, IPv6, localhost, origin address, and canonical hostname.
- Join CDN, WAF, proxy, load balancer, web server, PHP, WordPress HTTP API, cron, and plugin logs by request ID and timestamp.
- Check whether Authorization is consumed by the edge, removed during a scheme or host redirect, or omitted from the PHP server variables.
- Replace any broad public bypass with a narrow authenticated path and test that outside requests still receive the intended challenge.
Field notes
- Write the expected result before changing anything and keep one repeatable synthetic fixture for the full test window.
- Record exact versions and UTC timestamps because caches, retries, scheduled actions, and deployments can change the evidence between checks.
- Test the public path and the stored server-side result, not only an admin preview, isolated command, or API response.
- Review the result again after the relevant cache, queue, cron, webhook, and observation window has completed.
Useful command or data shape
Adapt paths, IDs, and privacy handling to the site before running commands or storing data on production.
curl -sS -D - --max-redirs 0 -u 'canary:REDACTED' https://staging.example.test/wp-cron.php
curl -sS -4 -o /dev/null -w '%{http_code} %{remote_ip}\n' -u 'canary:REDACTED' URL
curl -sS -6 -o /dev/null -w '%{http_code} %{remote_ip}\n' -u 'canary:REDACTED' URL
# Use a short-lived canary credential and remove it from history.
Why this usually happens
- HTTP clients commonly avoid forwarding Authorization across a host or scheme redirect.
- The CDN authenticates the request but does not pass the header to the origin.
- Apache, Nginx, FastCGI, or a proxy does not expose the header to PHP.
- Loopback DNS resolves to a different origin or IPv6 path with another auth policy.
Decision rule
Do not disable Basic Auth for the whole site to fix one loopback. Identify where the header or route changes, then preserve the intended external challenge while the owned self-request succeeds.
Production verification checklist
- The WordPress feature receives 200 with the expected body, not a login or challenge page.
- Authorization handling is consistent across CDN, proxy, server, PHP, IPv4, IPv6, and redirects.
- External unauthenticated requests still receive the intended protection.
- Temporary canary credentials, bypasses, and verbose logs are removed.
Safe fix order
Use a sequence that makes each result easy to prove. Stop when new evidence changes the scope or owner of the problem.
- Capture the exact loopback contract
- Trace every network hop
- Compare redirects and address families
- Repair the narrow header boundary
- Retest self and external access
Mistakes to avoid
- Changing production before recording exact versions, UTC timestamps, a stable fixture, the expected result, and a tested rollback point.
- Treating one successful screen as proof while logs, stored records, background jobs, caches, emails, APIs, and downstream systems remain unchecked.
- Testing only as an administrator instead of using the role, device, locale, cache state, request path, and failure branch that users actually reach.
- Leaving debug output, temporary exclusions, helper accounts, duplicate hooks, broad permissions, or relaxed firewall rules active after verification.
Questions teams ask during testing
Can I test this directly in production?
Start with read-only evidence. Use staging for code, package, security, checkout, form, privacy, or cache changes. If a production canary is necessary, make it identifiable, reversible, monitored, and incapable of exposing personal data or charging a customer.
How do I avoid a false positive?
Repeat the same fixture with the same versions, URL, role, locale, cache state, and downstream integration. Compare the public result, stored result, and logs instead of relying on one browser view.
What evidence should I retain?
Keep UTC time, exact versions, request or record ID, expected result, actual result, relevant log lines, change made, rollback point, owner, and final verification. Redact credentials, tokens, and personal data.
When is the work complete?
Close it when the primary path passes, failure branches are understood, stored and downstream records reconcile, temporary changes are removed, monitoring is active, and the owner has the evidence packet.
What to tell the client or owner
Give the owner a concise packet with the affected workflow, exact versions, UTC test time, synthetic fixture ID, expected result, actual result, key logs, change made, rollback point, final result, unresolved risks, owner, and next review date. Remove credentials and personal data before sharing it.
When HandL WP should help
Bring in help when this affects leads, checkout, search visibility, security, paid media reporting, or a client production site. HandL WP can trace the issue through WordPress, hosting, cache, tracking, and Search Console, then verify the workflow after the technical fix.
If this is active on a production site, have HandL WP debug a WordPress loopback error.
Related HandL WP guides
Use these related guides when the same issue touches tracking, security, checkout, or crawler visibility.
Helpful references