Incognito Password Reset Issue

We recently noticed a potential issue in the customer password reset pathway.

When you try and open a password reset link – https://imgur.com/Ko3gbr4 from your email in an incognito window you are faced with the following message: https://imgur.com/ZfQN1nm. When I try to click the 'Continue to site' button nothing happens.

I am not sure if this is a Woocommerce or WordPress security feature as the password reset link works fine when you click in a normal browser session (i.e. not icognito).

This issue seems related to a browser security feature, potentially combined with WordPress or WooCommerce configurations. The password reset link opening fine in a normal session but failing in incognito suggests it might be related to one of the following:

### 1. **CSRF Protection or Cookies**
– WordPress and WooCommerce often use cookies for session management and CSRF protection.
– Incognito mode can restrict third-party cookies, which might prevent the necessary cookies from being set or accessed.
– If your site is using a plugin or configuration that blocks password reset functionality when cookies are missing, this could explain the behavior.

### 2. **Content Security Policy (CSP) or Browser Blocking**
– If a strict Content Security Policy is implemented, some scripts might fail to load in incognito mode. Check the browser console for errors.
– Browser privacy settings in incognito mode might block the required JavaScript or redirect to a confirmation page, rendering the "Continue to site" button non-functional.

### 3. **Security Plugins or Hosting Features**
– Security plugins (like Wordfence, All In One WP Security, etc.) could block password reset attempts in incognito mode as a protective measure against brute-force attacks.
– Some hosting providers have built-in security that may require cookies or sessions to be enabled for such actions.

—

### Steps to Debug and Resolve:

1. **Test in Incognito with No Plugins**:
– Temporarily disable WordPress security plugins and see if the issue persists.
– If the issue disappears, isolate which plugin is causing the problem.

2. **Check Console for Errors**:
– Open the browser developer tools in incognito mode and reload the reset link.
– Look for JavaScript errors, blocked resources, or warnings related to cookies.

3. **Review WooCommerce and WordPress Logs**:
– Check your WooCommerce and WordPress logs for any errors related to password reset or session handling.

4. **Update Your Cookie Settings**:
– Ensure your site allows cookies to function even in incognito mode. If third-party cookies are essential, test with them enabled.

5. **Customize the Password Reset URL**:
– If your hosting or a plugin appends extra parameters (like tracking parameters), they might break functionality. Test the raw password reset link without any appended strings.

6. **Contact Hosting Support**:
– If you're using managed WordPress hosting, their security configurations might cause this behavior. Reach out to your hosting provider for insights.

—

Let me know what you find in the debugging steps, and we can further narrow down the issue!