网站订阅表单无法订阅，弹出身份验证请求问题求助

Hey there, let's break down why your Contact Forms 7 and Mailpoet subscription forms are asking logged-out visitors for a username and password—while working fine for admins. This almost always ties back to a permission or access restriction somewhere, so here are the key areas to check:

1. Server-Level Password Protection (.htaccess or cPanel) #

It’s possible you’ve accidentally password-protected a directory or URL path that your forms rely on to submit data. For example:

• Contact Forms 7 uses WordPress REST API endpoints like wp-json/contact-form-7/v1/contact-forms/* to process submissions
• Mailpoet similarly uses REST API paths under wp-json/mailpoet/*

How to check:

• Head to your cPanel (or hosting control panel) and look for "Directory Privacy"—verify that the wp-json directory, or your site’s root, isn’t set to require authentication.
• Open your site’s .htaccess file (via FTP or hosting file manager) and scan for lines like:

  AuthType Basic
  AuthName "Restricted"
  AuthUserFile /path/to/.htpasswd
  Require valid-user
  

  If you see these, check if they’re applied to a path that includes your form submission endpoints.

Fix:

• Remove the authentication rules if they’re unnecessarily restricting public access, or add an exception for the plugin-specific API paths.

2. Security Plugin Access Restrictions #

Plugins like Wordfence, iThemes Security, or Sucuri often include rules to block unauthorized access to sensitive areas—but sometimes they overreach and block form submission paths.

How to check:

• Open your security plugin’s settings and look for sections like "Firewall Rules", "Access Control", or "REST API Restrictions".
• Verify if there’s a rule that blocks unauthenticated users from accessing REST API endpoints, or specifically targets the paths used by CF7/Mailpoet.

Fix:

• Add an exception to allow unauthenticated access to the following paths (adjust based on your plugins):
  • wp-json/contact-form-7/v1/contact-forms/*
  • wp-json/mailpoet/*

3. Plugin Conflict or Misconfigured Forms #

A conflicting plugin might be interfering with your form submissions, or your form settings could be pointing to a restricted page.

How to check:

• Temporarily disable all plugins except Contact Forms 7 and Mailpoet, then test the subscription form as a logged-out user. If the prompt disappears, re-enable plugins one by one to find the culprit.
• For Contact Forms 7: Go to your form’s settings, check the "Mail" tab for any unusual redirects, and the "Additional Settings" tab for custom code that might enforce authentication.
• For Mailpoet: Verify your subscription form’s "After submission" settings are pointing to a publicly accessible page, not a restricted admin area.

4. Theme-Level Permission Restrictions #

Some custom themes add code to functions.php (or a custom plugin) that restricts access to the REST API or form submission actions for unlogged users.

How to check:

• Switch your site to a default WordPress theme (like Twenty Twenty-Four) and test the form. If the prompt goes away, your theme is the issue.
• Look through your theme’s functions.php file for code snippets that use rest_authentication_errors or check user roles before allowing form submissions.

Fix:

• Remove or modify the restrictive code, or reach out to the theme developer for a patch.

5. WordPress REST API Global Restrictions #

If your site has been configured to block unauthenticated access to the entire REST API, this will break any plugin that relies on it for form submissions.

How to check:

• Search your site’s code (via functions.php or custom plugins) for lines like:

  add_filter('rest_authentication_errors', function($result) {
      if (!is_user_logged_in()) {
          return new WP_Error('rest_not_logged_in', 'You are not logged in.', array('status' => 401));
      }
      return $result;
  });
  

• Also check if you’re using a plugin like "Disable REST API" with overly strict settings.

Fix:

• Remove the global restriction code, or adjust the plugin settings to allow unauthenticated access to necessary API endpoints.

Start with the server-level protection check first—it’s one of the most common causes of this exact issue. If you run into any specific hurdles while troubleshooting, feel free to share more details!

内容的提问来源于stack exchange，提问作者user2360597