A custom-built,

pneumatic tomb-puzzle in a suburban escape room will fail to thrill if the players are forced to recall a sequence they saw in a different room three years ago. As a designer of these physical narratives, I know that if a player gets stuck, it is almost never because they are “bad at puzzles,” but because the environmental cues failed to lead their brain where it needed to go.

We do not blame the paying customer for failing to remember a code we hid under a rug six months ago; we admit the puzzle is broken. Yet, in the digital architecture of our membership sites and guilds, we have spent two decades doing the exact opposite. We build digital doors that require a specific, arbitrary key, and when our members lose that key, we convince them that they are the ones who are broken.

The Quiet Hypocrisy of “Locked Out”

The 2021 Apple iPad Air, a frayed braided charging cable, and a half-eaten bowl of cold popcorn sit on Carol’s lap as she stares at the red error message. Carol is seventy-one years old and has been a pillar of the regional quilting guild for twenty-two years. She can navigate a complex Mariner’s Compass block pattern without breaking a sweat, but the login screen for the guild’s member portal has defeated her for the third time since January. It is Sunday, 9:40 p.m., and Carol is currently typing an email to Denise, the volunteer membership secretary: “Locked out AGAIN (my fault).”

Denise is on her couch with a 2023 MacBook Pro on a velvet cushion, looking at the backend of a WordPress installation that she barely understands herself. She sees Carol’s name in the user list, clicks the reset button, and prepares the standard response: “No worries! Maybe keep it on a sticky note by the computer?”

Denise sends the email, feeling a small surge of helpfulness, and then looks at the physical sticky note on her own monitor that contains the guild’s administrative password. This is the quiet hypocrisy of the modern web: we give advice we know is insecure because the alternative-remembering thirty-seven different strings of alphanumeric nonsense-is biologically impossible for the average human mind.

“Locked out AGAIN (my fault).”

– Carol, Pillar of the Quilting Guild

We have designed a system that depends on a member recalling an arbitrary string of characters used roughly once every ninety days. According to the forgetting curve, a formula that describes the decline of memory retention in time, humans lose about 70% of new information within twenty-four hours if there is no attempt to retain it.

Asking a member to remember a password they created in a flurry of activity four months ago is not a test of their intelligence; it is a mathematical certainty that a significant percentage of them will fail.

Lessons from the B-17 Flying Fortress

The B-17 Flying Fortress, a four-engine heavy bomber used during World War II, provides a stark historical parallel for this kind of design-induced failure. During the war, B-17 pilots were frequently involved in accidents where they would accidentally retract the landing gear while still on the runway, causing the massive planes to belly-flop and sustain catastrophic damage.

For years, the military blamed “pilot error,” citing fatigue, lack of focus, or poor training as the primary causes for these expensive mistakes. They put the pilots through more classes and gave them more checklists, yet the belly-flops continued at a predictable, devastating rate.

It was not until psychologist Alphonse Chapanis investigated the stickpit that the real issue came to light: the lever for the landing gear and the lever for the wing flaps were identical and placed right next to each other. In the high-stress environment of a landing, pilots would reach for the flaps and pull the gear instead.

Chapanis solved the problem not with more training, but with “shape coding.” He attached a small rubber wheel to the landing gear lever and a wedge-shaped piece of plastic to the flap lever. The “pilot error” vanished overnight because the system finally accounted for how human hands and brains actually work: they feel before they think.

We have placed the burden of security on the memory of the user, and when they pull the wrong lever, we tell them to try harder next time. This creates a hidden attrition rate that most organizations never actually measure. When an older member like Carol finds the login process too painful, she does not always send an email to Denise.

Sometimes, she simply stops visiting the site. She doesn’t renew her membership because the “friction tax” of getting through the front door has become higher than the value of the content inside. The organization looks at their Google Analytics and concludes that their audience “isn’t very online,” when the truth is that they have built a front door that punishes anyone who doesn’t visit every single day.

The Aesthetic of Authentication

A matte-black Herman Miller Aeron chair, a dusty Blue Yeti microphone, and three empty sparkling water cans surround me as I think about this problem from the perspective of an escape room. In my world, if a player has to stop the game to ask for a hint on how to open a door, I have failed as a designer.

The door should be the least interesting part of the experience. It should be a gateway, not a gate. Yet, the default WordPress login screen-the white box with the gray background and the lonely “lost your password?” link-is a gate that exists in a vacuum. It looks nothing like the guild’s website, it offers no comfort, and it demands a level of precision that most people reserve for their tax returns.

This is where the transition to modern authentication becomes a matter of empathy rather than just technology. When we implement tools like magic links or passkeys, we are essentially “shape coding” our levers.

A magic link allows Carol to click a button, receive an email, and click another button to be instantly logged in. There is no string to remember, no sticky note to lose, and no apology to write. Passkeys go a step further by using the biometric security already built into her iPad-the same thumbprint she uses to unlock the device-to verify her identity. The security is actually higher than a password, yet the cognitive load is zero.

I checked the fridge three times for new food while writing this, a classic procrastination habit that reminds me how often we seek a “reset” when we are frustrated. Every time Carol has to reset her password, she is experiencing a micro-trauma of digital inadequacy. She feels “hopeless with these things,” a phrase she has used so often it has become part of her identity.

But she isn’t hopeless; she is just being asked to use a tool that was designed by people who assume everyone is as obsessed with digital systems as they are. If we want our organizations to thrive, we have to stop treating the “I can’t get in” email as a support ticket and start treating it as a design flaw.

Using a plugin like HMDIA allows a site owner to bridge this gap by replacing the hostile default login with something that actually feels like part of the community.

When the login form sits inside the site’s own design, it maintains the “scenic continuity” of the user experience. It doesn’t feel like being redirected to a cold, digital interrogation room. By offering options like Google Sign-In or SMS One-Time Passwords, the system meets the user where they are, rather than demanding the user climb a wall to reach the system. This isn’t just about convenience: it is about accessibility for a demographic that is increasingly being pushed out of digital spaces by overly complex security hurdles.

The Receipt of Digital Debt

The blame also trains people to hide friction, which is the very information an organization needs in order to fix anything. If Carol feels like her lockout is “her fault,” she won’t complain about how hard the site is to use. She will just quietly disappear.

We lose her wisdom, her quilting expertise, and her membership dues because we were too attached to a nineteen-nineties authentication model. The technology to fix this has existed for years, but we have been slow to adopt it because we have been too busy telling Carols of the world to write their passwords on sticky notes.

We allow Denise to spend her Sunday night doing something other than resetting accounts, and we allow Carol to spend her time looking at quilting patterns instead of staring at a “Password Incorrect” message. The success of a digital platform should not be measured by how many people can navigate its hurdles, but by how many people don’t even realize the hurdles are there. Security is vital, but when security is used as an excuse for bad design, it ceases to be a shield and becomes a barrier.

We need to stop asking our members to be “better” at the internet. The internet should be better at being for them. If an escape room required a three-month-old memory to solve the final door, nobody would ever win, and nobody would ever come back.

It is time we applied that same standard to our websites. We should design doors that open for the people they were built for, without requiring them to apologize for being human.