The login cookie is named 'wp-postpass_' . COOKIEHASH
where COOKIEHASH
is either defined in your wp-config.php
or in wp-includes/default-constants.php function wp_cookie_constants()
.
The value is:
$hasher->HashPassword( wp_unslash( $_POST['post_password'] ) )
Whenever the password is changed, the cookie doesn’t match anymore, and is_user_logged_in()
must return FALSE
.
Send your users to the login screen immediately after they changed the password.
Or authenticate the user after the password saving:
require_once ABSPATH . 'wp-includes/class-phpass.php';
$hasher = new PasswordHash( 8, true );
$expire = apply_filters( 'post_password_expires', time() + 10 * DAY_IN_SECONDS );
setcookie( 'wp-postpass_' . COOKIEHASH, $hasher->HashPassword( wp_unslash( $_POST['post_password'] ) ), $expire, COOKIEPATH );
Related Posts:
- Custom login form
- Adding extra authentication field in login page
- Make my wordpress blog remember my login “forever”
- How to check in timber if user is loggedin?
- Stop WordPress from logging me out (need to keep me logged in)
- Does wp_logout_url() destroy a session? (Logging out question)
- Customize wp_new_user_notification_email()
- Need to execute a cron job
- Login email after registration never sent or received
- How to keep always logged in development environment
- Add Confirm Password field in wp-login.php Password Reset page
- Gaining Login Access via the Database
- send users logging in from wp-login.php directly to home page of site, rather than dashboard
- Changing Login Logo
- Get user ID after logging in
- How can I retrieve the username and password from my WordPress installation?
- User Directory without a Plugin
- User logon by using mobile number [closed]
- Pre checking condition before login
- wp-admin seems to be redirecting
- Custom Connect to Facebook, problem logging in/logging out
- WordPress login urls
- Redirect after empty login username and password
- WordPress Login page trashed
- Are there ways of logging in that bypass wp-login.php altogether?
- How does WordPress handle sessions?
- Change Favicon on Login Screen?
- Customizing the WordPress login form
- How to display username and password after registration
- wp-login gives 404 error, but wp-admin is working fine
- Login error redirecting to wp-login page
- Custom login message for single post pages only
- Private page protected with username and password
- Password protect media attachment – share across guests
- Password reset – Disabled for LDAP accounts
- Replace dash with space in username on login
- Autologin only working the second time
- Completely replacing the login form
- Why wp_update_user doesn’t update user_activation_key on users with apostrophes in their email?
- Forgot Password/ Password Reset Page does not exist
- WordPress on Apache behind nginx using letsencypt issue with loginizer/limit login attempts
- Auto login between word press subdomain and a .net website
- Custom Login form from WordPress site to non-WordPress site
- WordPress error on log out ‘Not Permitted’ and can’t log out
- How can I change the email sender name from wordpress to (myblogname) on the “lost password” email?
- Changed primary domain and now wordpress login won’t work
- Add logout link when logged in, make it disappear when logged out?
- Keep user session with custom implementation of user login
- Is there anyway to get the inputted password string from the login form?
- Invalidate username if it contains @ symbol
- WordPress Login and Register Link
- Login and Forgot password in Lightbox
- WordPress Login redirection according to user role
- Getting a person’s username from a wordpress cookie
- Prevent display password on wp-login.php
- WordPress ‘limit_login_lockouts’ using internal ip adress
- wp_get_current_user does not work properly on log in page
- How do I limit access to wp-admin to an IP range?
- Where is the php file, that does the checks for login information?
- WordPress Logout Problem [closed]
- “if is logged in” doesn’t work for me [closed]
- Timezone Change Locked Me Out? [closed]
- One time login on 2 different WordPress sites
- How are all users now set to inactive?
- Membership Plugin with Facebook integration [closed]
- How to create separate login for authors/moderators/subscribers?
- Unable to login into WordPress 401
- Custom user roles are unable to login
- Google reCaptcha on WP login page
- Recovering log in information
- Log in only by email and no username
- Extend Cookie with auth_cookie_expiration not working
- Modify wp-login.php Labels Conditionally Based On Referring URL
- WordPress login page not display
- WordPress Login & Register works in localhost but don’t work on server
- Opening WordPress on wordpress.example.com, while the webpage is at example.com
- New user password confirmation sending wrong URL
- Stop customers and subscribers from login to dashboard
- prevent login after incorrect password 5 times
- Why does /wp-admin login send me to this landing page?
- Locked out of WordPress admin area [closed]
- WordPress login page blank after customizations – works on other sites
- WordPress does not send email confirmation to newly registered users
- How to dequeue the default CSS styles on the wp-login.php page?
- confirmation email is send from my local host registration of a user but mail will not display in there email account?
- Server error after log in
- How do I resolve my inability to login to WordPress dashboard? [duplicate]
- Chrome incorrectly displaying WP login as ‘not fully secure’
- Changed from HTTP to HTTP, can login no longer login
- Hide wp-login.php but not the widget
- Without user loging inner page is disable wordpress [duplicate]
- Registration and Login form
- WordPress and Magento: let WordPress manage user registration and logins?
- Share login status across subdomains without network
- How to change the login URL
- How to find out what’s causing (broken) ajax login
- Click on banner to register to the blog
- Cannot login into an old wp site. Fatal Error: Cannot create references to/from string offsets
- Entire WordPress content disappears
- Remove login link from Reset Password-screen