What this means
The plugin sentence: The login page did not answer at wp-login.php, so it could not be checked. Its address has probably been changed, often by a security plugin. Since version 1.0.1 the plugin checks the login address WordPress gives, so this sentence means that this address, too, could not be confirmed as the login page.
Check C1 asks for the login page at the address WordPress gives (wp_login_url()), and counts it only when it answers 200 with the form WordPress itself prints. A 404, a 403, a redirect to the home page, or a page without that form is not confirmed. The plugin follows one redirect to the login page on your own site and never guesses a hidden login address.
A security plugin that moves the login page through the WordPress filters, as WPS Hide Login does, makes WordPress give the new address, so C1 measures it there and this reason does not appear. In the report you copy, that address shows as [custom login URL]. The reason appears when the page is hidden in a way WordPress does not know about, or when wp-login.php sends people to a sign on page on another host, which the plugin does not follow.
Like every request Edge Doctor sends, these go only to the hosts of your Site Address and WordPress Address (home_url() and site_url()). An address WordPress gives on another host, such as a single sign on page, is never requested.
Checks that report it
Only this check reports it, and only when wp-admin was fine:
If wp-admin itself is cached or reached by a cache rule, C1 reports that as a failure or a warning, and this reason becomes a note.
Symptoms you may notice
- Check C1 says Could not check, while wp-admin is not cached.
- Opening the login address in a private window shows a 404, the home page, a sign on page on another site, or a page without the WordPress login form.
Why it happens
Security plugins often move or hide the login page to reduce automated login attempts, and some sites send users to single sign on. Both are deliberate choices, not faults.
Confirm it by hand
curl -sI "https://example.com/wp-login.php" | grep -iE "^HTTP|^location|cf-cache-status"A location on another host is a sign on redirect; a 404 or a redirect home means the page was hidden.
How to fix it
Usually nothing: if the login page was moved or hidden on purpose, keep it. C1 then rests on wp-admin alone.
In WordPress: if your security plugin can move the login page through the WordPress filters instead of hiding it, the check measures the new address on the next run.
In Cloudflare: make sure the Cache Rule that covers your HTML also leaves the custom login address out; the plugin cannot test an address it was not given.
Limitations
A login address WordPress does not give is never tested, because the plugin does not guess it.
Related checks
- C1 wp-admin and the login page in the cache
- C5 Login cookies and private responses: covers the login cookie on every page.
Run these checks on your own site with Edge Doctor for Cloudflare®, free on WordPress.org.
Edge Doctor for Cloudflare® is not affiliated with or endorsed by Cloudflare, Inc. Cloudflare is a registered trademark of Cloudflare, Inc.