Expression Engine v2.6.1 - Build Date: 20130506

I have a live server and a dev server. They are identical.

The problem

On the live site, members cannot login on the front end. I can login with my admin un/pw to the control panel, but I cannot via the front end. When I try to login I am taken to the homepage of the site and I am not logged in.

The front end doesn't recognise that I am logged in in the control panel either.

All of this has just started today. No changes have been made.

The dev server works as it should (logs in fine)

I have tried

To solve this issue I have tried:

  • Changing the session options security settings
  • Deleted cookies and browser history etc
  • Setting a cookie name .example.com
  • Checking to see if the front end recognises me as logged in to the control panel (it doesn't)
  • I have set up a basic form to test logging in away from the main front-end code. Here is the form:

    {exp:member:login_form return="http://www.exmaple.com/some_test"}
                <input type="text" name="username" value="" maxlength="32" size="25">
                <input type="password" name="password" value="" maxlength="32" size="25">
        <p><input type="submit" name="submit" value="Submit"></p>


Everything works on the dev site as expected. On the live site (using the test above) I try to login and it just re-routes me to homepage and doesn't log me in.

My question

Apart from updating the CMS, what would be you recommend doing next?

This issue exists on Chrome, FF and Safari on Win7 and Mac 10.9

  • Check your .htaccess file for redirects from www to no-www - also check to see if your host is doing that at the server-level. If your form is posting to www.domain.com, but it's being redirected, this can cause silent failures. Apr 2, 2014 at 15:55
  • Yeh I suspected that the htaccess might be the root cause, but couldn't understand it as the dev and live are with the same host and therefore the htaccess is pretty much idenitical. Anyway - got it working and have posted the answer.
    – gelviis
    Apr 3, 2014 at 9:52

2 Answers 2


You say nothing has changed but something must have. Even if it's a change to the server set up (perhaps made by your host) it could have an effect. So it might be worth asking your host if any updates were made in the last 48 hours. This may at least give you a clue.

Were any options changed in the site CP? Such as cookie settings, requiring and IP and user agent, prevent multiple logins etc. These could all have an effect too.

One thing you might want to check is under Admin->Security and Privacy Settings and try changing the method being used for the User Session Type. Just switch it to another option, clear your cookies and try again. That might work.

  • exactly what i first thought, cookie settings. And use devtools or firebug to check what happens in the network pane. check redirects, headers etc.
    – GDmac
    Apr 3, 2014 at 10:34

I upgraded and still had some issues. The form has to be handled over HTTPs. This is the form (without the styling) I ended up with that works on all servers:

        <form method="post" action="https://www.example.com/area">

            <input type="hidden" name="ACT" value="15">
            <input type="hidden" name="RET" value="https://www.example.com/area">
            <input type="hidden" name="site_id" value="1">
            <input type="hidden" name="csrf_token" value="{csrf_token}">

            <input type="text" name="username" value=""/>
            <input type="password" name="password" value=""/>

            <button type="submit" name="submit" value="Submit"/>Sign in</button>


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.