Troubleshooting Tip: The FortiGate login GUI page is unresponsive

The device is accessible via SSH or console cable to check the crash logs.

In the crash logs, the daemon http_authd keeps crashing and consuming high cpu.
One reason for this is that the daemon is engaged in verifying invalid users attempting to log in to the FortiGate with the public IP.

It is generally considered safe not to expose the WAN IP to the public by disabling direct access via HTTP and HTTPS. Instead, access the device via secure VPN connections or management portals that restrict access to authorized users. This approach helps protect the network from unauthorized access and potential attacks.

Solution:

Interface settings. GUI access, HTTP, and/or HTTPS have to be disabled on the interface.

CLI commands:

config system interface
    edit <interface name>
        set allowaccess ping 
end

diagnose debug crashlog read

16370: 2026-03-17 04:27:12 the killed daemon is /bin/http_authd: status=0x100
16371: 2026-03-17 04:59:19 the killed daemon is /bin/http_authd: status=0x100
16372: 2026-03-17 05:11:18 the killed daemon is /bin/http_authd: status=0x100
16373: 2026-03-17 05:13:13 the killed daemon is /bin/http_authd: status=0x100
16374: 2026-03-17 05:23:36 the killed daemon is /bin/http_authd: status=0x100
16375: 2026-03-17 05:33:15 the killed daemon is /bin/http_authd: status=0x100
16376: 2026-03-17 05:43:29 the killed daemon is /bin/http_authd: status=0x100
16377: 2026-03-17 06:17:18 the killed daemon is /bin/http_authd: status=0x100
16378: 2026-03-17 06:33:20 the killed daemon is /bin/http_authd: status=0x100
16379: 2026-03-17 06:49:19 the killed daemon is /bin/http_authd: status=0x100
16380: 2026-03-17 06:57:21 the killed daemon is /bin/http_authd: status=0x100
16381: 2026-03-17 08:07:19 the killed daemon is /bin/wad: status=0x0
16382: 2026-03-17 08:07:20 the killed daemon is /bin/ipsmonitor: status=0x0
16383: 2026-03-17 08:08:19 the killed daemon is /bin/cw_acd: status=0xd
16384: 2026-03-17 08:08:19 the killed daemon is /bin/cw_acd_helper: status=0x2

After disabling HTTPS and HTTP and restarting the http_authd daemon, the CPU and memory consumed by the daemon are released.

fnsysctl killall http_authd

In FortiOS v7.6.4 and later, a new internal daemon, 'http_authd', is responsible for centralized GUI authentication and authorization. Refer to the release notes for more information Enhance administrative authentication and session monitoring.

To check the logs of invalid users trying to access the device.

Navigate to Log & Report -> System events -> General system events.

Or run the command 'diagnose alertconsole list', which is useful in identifying login failures; the command also displays the source IP where the attempt originated.

Related articles:
Technical Tip: Steps to confirm a Brute Force attack  

Troubleshooting Tip: Unable to access GUI in firmware version 7.6.4 and later 

Troubleshooting Tip: FortiGate GUI becomes unresponsive when filter is applied to the logs