S7-1200 Webserver Bit Change Failed: Admin Login Fix

Problem Overview

A common complaint when commissioning the S7-1200 standard web server with user-defined pages is that monitored values render correctly in the browser yet the operator cannot toggle a bit or write an integer back to the CPU. Symptoms include:

• Numeric tags refresh in real time on the user-defined page (polling visible).
• Clicking a write button, slider, or text-input submits the form but the tag never updates in TIA Portal watch table or online monitoring.
• No PLC diagnostic buffer entries are produced; no SF/BF LED activity changes.
• Behavior is identical across Google Chrome, Microsoft Edge, and Internet Explorer 10/11.

This fault is reported on the 6ES7 214-1AG31-0XB0 (CPU 1214C DC/DC/DC) with firmware V3.0.2 after installing the Siemens example project "Web Server - Creating and using user-defined web pages on S7-1200" (Siemens Support entry ID 58862931). The root cause is not a defective AWP page, not a browser defect, and not a hardware defect. The CPU is enforcing its role-based access model correctly; the HTML page is being served to an anonymous session that has read-only rights.

Affected Hardware and Firmware

The fault is independent of signal module (SM), communication processor (CP), or signal board (SB) configuration. Adding SMs does not change the access policy.

Root Cause Analysis

The S7-1200 web server uses three privilege levels defined in the CPU's Web server configuration object in TIA Portal:

1. Anonymous - read-only. Default. Activated automatically when the Web server is enabled.
2. Standard user - read-only access to additional pages if explicitly granted; cannot write variables.
3. Administrator ("admin") - read/write to all CPU variables and tags exposed via AWP commands.

When a browser hits the standard web page (http://<cpu-ip>/) without credentials, the session token is anonymous. Any subsequent HTTP GET or POST to a user-defined page (/awp/<file>.html) inherits that anonymous session. The CPU parses the AWP_In_Variable and AWP_Out_Variable tags inside the HTML and answers GETs (reads) with current values, but POSTs that contain an AWP_In_Variable field with the := operator are silently discarded because the session role is not authorized for writes.

The Siemens S7-1200 System Manual explicitly states that writes from user-defined pages are only permitted after the operator has successfully authenticated against the standard web page. See the Web server chapter in the S7-1200 Programmable Controller System Manual on the Siemens Industry Online Support portal.

Resolution: Enable the Administrative Login

Step 1 - Confirm Web server is activated

1. In TIA Portal, select the S7-1200 CPU in the project tree.
2. Open Properties > Web server.
3. Verify Activate web server on this CPU is checked.
4. Note the IP address shown under Ethernet interface PROFINET [X1].

Step 2 - Configure the administrator password

1. In the same Web server dialog, switch to the User management section.
2. Confirm the user admin exists with role Administrator.
3. Set a password (8–32 characters, case-sensitive). The firmware V3.0.2 ships with admin no password by default; V4.x and later require a password to be set before the admin role can write.
4. Compile and download the project to the CPU.

Step 3 - Download the user-defined pages

1. Right-click the CPU in the project tree and choose Web server > Download user-defined pages.
2. Confirm the HTML files (e.g., index.html, script.js) are transferred to the CPU's internal load memory under the WWW directory.

Step 4 - Authenticate from the browser

1. Open a browser and navigate to http://<cpu-ip>/ (the standard Siemens welcome page).
2. Locate the Log in link on the left navigation pane.
3. Enter admin as the user name and the configured password.
4. Wait for the page to confirm successful login (the upper-right corner changes from "Anonymous" to "admin").

Step 5 - Navigate to user-defined page

1. In the left navigation pane under User-defined pages, click the page link (e.g., index).
2. Verify the URL now begins with /awp/index.html and that the session cookie siemens_automation_token is present (visible in browser DevTools > Application > Cookies).
3. Toggle a write control. The tag now updates in TIA Portal watch table within one scan cycle.

AWP Command Reference for User-Defined Pages

Automation Web Programming (AWP) commands are HTML comments parsed by the CPU. The following table summarizes the canonical commands used in the Siemens example project 58862931.

Implementing a Secure Login Page

From firmware V4.0 onward the CPU supports HTTPS (TLS 1.2) and certificate-based login. V3.0.x only supports HTTP. To harden a V3.0.2 deployment while you still cannot enable TLS, restrict network exposure:

• Place the CPU on a dedicated VLAN with no Internet egress.
• Use PROFINET port-based isolation or a managed switch ACL.
• Set a non-trivial admin password (12+ characters, alphanumeric + symbols).
• Disable Permit access with PUT/GET (from remote partner) in the CPU protection dialog unless absolutely required.

When upgrading to V4.2 or later, switch the standard page to HTTPS by importing a self-signed certificate via TIA Portal > Web server > Certificate management. The browser will warn on the first connection; the operator must add the certificate to the trusted store.

Verification Procedure

1. In TIA Portal, open the Watch table containing MotorStart and Speed.
2. Click Monitor all to display live values.
3. From the logged-in browser session, click the toggle / change the integer / submit the form.
4. Confirm the watch table reflects the new value within 1 second.
5. Open a second browser (private/incognito window) and repeat the write attempt without logging in. Confirm the write fails - this validates the access control model.

Acceptance criterion: writes succeed only when an authenticated admin session cookie is present.

Firmware-Specific Behavior (V3.0.x vs V4.x)

If upgrading V3.0.2 to V4.x, recompile the user-defined pages and re-download them. AWP syntax is backward compatible; old pages work, but encrypted upload requires the certificate infrastructure.

Browser Compatibility Matrix

Common Related Faults and Workarounds

Security Configuration Best Practices

• Principle of least privilege: Create one operator user with read-only access. Reserve the admin role for commissioning engineers only.
• Disable PUT/GET in the CPU protection dialog if you are not using legacy S7 communication.
• Rotate passwords at each major commissioning phase. Use a credential manager to avoid sticky notes on control cabinets.
• Audit CPU diagnostic buffer for "Web server login successful" entries - the V4.x firmware logs every authentication event.
• Hide the standard welcome page if the user-defined page is the only intended operator HMI: this prevents curious operators from poking at tag lists and diagnostic buffers.
• Network segmentation: Place the control LAN on a non-routable VLAN behind a managed switch. The S7-1200 web server has no rate limiting; an attacker on the same Layer-2 segment can attempt credential brute-force without any throttling.

Migration Path: User-Defined Pages to Modern Web API

For new deployments on V4.2 or later, evaluate whether user-defined HTML pages are still the right tool. The S7-1200 exposes a JSON-over-HTTPS web API that allows GET/POST of tag values directly. The endpoint pattern is:

This approach removes the need for AWP syntax entirely, integrates cleanly with Node-RED, Ignition, Grafana, and custom React front-ends, and benefits from the TLS infrastructure already built into the firmware. It is, however, still subject to the same admin-login requirement - the operator must authenticate before any write is honored.