Logged-in administrators often bypass page cache, CDN optimisation and security rules. They also receive different cookies, HTML and scripts. A successful admin test can therefore conceal the exact visitor path that is broken.
Make logged-out testing the baseline.
Reproduce in isolated sessions
Use a fresh private browser with no WordPress cookies. Submit one harmless uniquely labelled test and record network/console activity.
Compare the same URL while logged in, but do not mix sessions or browser caches. Save the initial HTML/script URLs for both.
Check whether a public entry is saved even when no success message/email appears.
Compare cache and nonce behaviour
Inspect cache headers and the form’s nonce/token age. Logged-in users normally bypass full-page cache while visitors may receive an old form token.
Purge the affected page, exclude dynamic form endpoints and configure supported cache compatibility. Do not disable all caching indefinitely.
If a CDN varies HTML by cookie/device, test the exact public variant.
Inspect role and permission checks
Custom form handlers sometimes require is_user_logged_in() or a capability inadvertently. REST endpoints can also be registered with an incorrect permission callback.
Review the handler code/plugin configuration in staging. Public forms must use anti-abuse/nonces without requiring administrator permissions.
Do not make a sensitive internal form public merely to fix the test; confirm intended audience.
Compare scripts and optimisation
Administrators may receive unminified or excluded JavaScript. Visitors may receive delayed/combined assets or consent-blocked CAPTCHA.
Record console errors and the submission request. Disable one optimisation/tag at a time in staging and identify the smallest exclusion/dependency chain.
Do not treat hiding the error as repair. Confirm the POST reaches the server.
Review WAF and anti-spam decisions
Cloudflare, ModSecurity, security plugins, CAPTCHA or honeypots may trust administrator cookies/IP and block anonymous visitors.
Find the exact event/rule ID and test representative visitor data. Narrow the exception to the legitimate form action without bypassing all POST/security checks.
Check rate limits from shared mobile/company networks.
Check notification conditions
If entries save for both roles but only admin tests email, compare values used by conditional notifications. Administrator autofill or account data may populate a required field that public visitors leave empty.
Review To/From/Reply-To tokens and mail logs. Use an authenticated domain From address.
The front-end role difference and mail delivery can be two separate faults.
Verify the complete visitor journey
Test logged-out desktop/mobile, required validation, consent, CAPTCHA, attachments and one successful submission. Confirm one entry, one provider-accepted email and final mailbox delivery.
Test logged-in behaviour too so the repair does not regress administration.
Monitor public errors and conversion events after release.
Use a controlled comparison
Run administrator and visitor tests with the same browser, fields and recipient, then change only the login state. Label both submissions and record their request status, entry ID and mail-log result. This prevents an autofilled address, different consent choice or cached page from being mistaken for a permissions problem.
Inspect the page in a private window without browser extensions. If the public form depends on a cookie or a script that appears only after consent, verify both valid consent paths. Do not disable security or privacy controls globally to make the test pass.
After identifying the difference, apply the narrow correction and clear only the affected cache layer.
Repeat the comparison after signing out again; an administrator session can otherwise hide the original public failure.
When to request repair
Request help when cache/nonces, WAF or role checks differ. Send the public URL, timestamp, request status and redacted error—never form entries or passwords.
The outcome should prove anonymous visitors can submit safely, while protected/internal forms remain restricted as intended.