No as it will be insecure to do it. Being able to display the password to the user means that you store it as a plain text somewhere which is a big no no. Emails ending in spam should not be relevant here as you should not send passwords in email. (sure you can hack … Read more
After researching and looking up the WordPress Codex, this is the code that I have used to authenticate.. I hope this helpful to all friends .it’s working fine for me 🙂 $creds = array( ‘user_login’ => $username, ‘user_password’ => $userpassword, ‘remember’ => true ); if(!empty($username) && !empty($userpassword)) { if(!username_exists($username)) { $userdata = array( ‘user_login’ => … Read more
Can they for example simply copy the cookie and “be” logged in as the user who was the original cookie owner? Yes! with the cookie they basically have your login session. You do not want 3rd parties to get the cookie. Keep in mind there is more than 1 cookie, for frontend and for backend. … Read more
Yes, you can hook determine_current_user. This is how WordPress calls the existing code that processes authentication cookies: add_filter( ‘determine_current_user’, ‘wp_validate_auth_cookie’ ); add_filter( ‘determine_current_user’, ‘wp_validate_logged_in_cookie’, 20 ); e.g. see the implementations of those in wp-includes/pluggable.php. Your filter should return the user ID of the user you want to authenticate as once you’ve processed the headers. That … Read more
If you looked at your plugins one by one and none of them causes the problem, look at your template files that display your home page – could be index.php, home.php, content.php, content-{slug/id}.php or page-templates/…, depending on your theme and settings. Look for if (!is_user_logged_in()) { auth_redirect(); } or anything that seems to resemble this. … Read more
You do not need to rewrite wp_set_auth_cookie(), it allows you to change the expiration time of the cookie: add_filter( ‘auth_cookie_expiration’, ‘wpse101378_change_expire_time’, 3 ); function wpse101378_change_expire_time( $expire, $user_id, $remember ){ //The $remember variable indicates whether the user has elected //to be ‘remembered’. //By default, if true, WP sets expire to 14 days if false, 2 days … Read more
Here is part of a multisite plugin I wrote that forces a user to log in. It required a user to be registered for the site; not just be a network user. It could be modified to check if user has a higher role. I did modify it to fit the OP requirements. add_action( ‘init’, … Read more
wp_authenticate() just checks user data, but not actually authenticating – docs. You can use wp_signon, which uses and wp_authenticate: source, like this: $credentials = [ ‘user_login’ => $name, ‘user_password’ => $password, ‘rememberme’ => true, ]; $signon = wp_signon($credentials, true); // true – use HTTP only cookie if(is_wp_error($signon)){ return false; } // The user is logged … Read more
get_current_user_id() effectively does what @Giri had described in the first snippet. The internal WordPress function-call chain eventually calls get_currentuserinfo() which already checks if there is a WP_User object, meaning a user is logged in. Thus, from what I can see in the linked code, get_current_user_id() always returns the ID of the user that is logged … Read more
Do not set header in a template file. Those are part of the HTTP request itself. About your problem: Add a template (whatever file you need – see “Template Hierarchy”). On top of it you include the default stuff like get_header(); and so on. For the restricted part, you use the following: if ( current_user_can( … Read more