Auto Login After Registration

Here’s a basic approach.

First, you would need to pass something in the link to give some user info you can use to log the user in. To do this, you need to filter the email that goes to the user. (It would be possible to actually load a custom new user registration email, but this would have to be done as a plugin as that function is a pluggable function. Instead of doing that, this method just filters the email content based on the subject line for the registration email.)

// Add filter for registration email body

add_filter( 'wp_mail', 'set_up_auto_login_link' );

function set_up_auto_login_link( $atts ) {

    // if the email subject is "Your username and password"
    if ( isset ( $atts ['subject'] ) && $atts['subject'] = 'Your username and password' ) {
        if ( isset( $atts['message'] ) ) {

            $old = '/wp-login.php';
            $new = '/wp-login.php?user=" . $_POST["user_login'];

            $atts['message'] = str_replace( $old, $new, $atts['message'] );
        }
    }
    return $atts;
}

This will put the selected username from the registration form into the email in the form of a query string added to the login link. That username can be used to log the user in when they click the link.

To do this, I’ve hooked to the init action. This will check for the “user” parameter in the query string. If that exists, it uses get_user_by to get the user data by their username (login). If that returns a valid user, we can use the username and the retrieved user ID to log the user in:

add_action( 'init', 'log_user_in' );
function log_user_in() {
    if ( isset( $_GET['user'] ) ) {

        // get the username from the URL
        $user_login = $_GET['user'];

        // get the user data (need the ID for login)
        $user = get_user_by( 'login', $user_login );

        // if a user is returned, log them in
        if ( $user && ! user_can( $user->ID, 'manage_options' ) ) {
            wp_set_current_user( $user->ID, $user_login );
            wp_set_auth_cookie( $user->ID );
            do_action( 'wp_login', $user_login );
            wp_redirect( home_url() );
            exit();
        }
    }
}

Note, this process doesn’t give you any real security since anyone with a valid username could log in as that user. It does check to make sure the user being logged in is not an admin (user_can(‘manage_options’)) otherwise anyone with the admin user login could gain access. It would be wise to build in some additional checks – probably create a key or hash to add to the link as well, something done at registration that could be used to validate the user.