The same applies to $live_site. If it's not empty then your login URL must match both the protocol and exact subdomain for Joomla's login cookie to be valid.
Example: $live_site = 'https://www.example.com'
If you try to log in from:
- http://example.com --> FAIL (protocol is HTTP instead of HTTPS, subdomain blank does not match expected subdomain www)
- http://www.example.com --> FAIL (protocol is HTTP instead of HTTPS)
- https://example.com --> FAIL (subdomain blank does not match expected subdomain www)
- https://www.example.com --> SUCCESS
Things get more complicated if you are redirection between HTTP and HTTPS and / or www to non-www or vice versa.
It's advisable that you use HTTPS and www and stick with it, possibly enforcing them with redirections on your .htaccess. If there's mismatch between where you are trying to log in and where Joomla expects to create the cookie for you won't remain loged in, login actions do get triggered and you won't get an error. This is, in fact, the expected way Joomla or any web application for that matter is supposed to work for security reasons.
Nicholas K. Dionysopoulos
Lead Developer and Director
🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!