WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to create a virtual user on WordPress, I mean the username and password will not exist in the database or in the Dashboard but if I login, the username and password must be recognized and the WP go normaly? The username and password will be encoded in php code into some file (plugin maybe). It is possible or I am searching in desert?

Until now I realise this: I can login with username=example and password=asdfgh, and it is login with the user ID=1. It is somehow a virtual user, but the login process involve some real user in database. Thanks.

/*Plugin Name: A Login

function alogin_virtual_login($username,$password) {
    if ( isset($username) && isset($password) )
        if ( ($username == "example") && ($password == "asdfgh") )
            return true;

    return false;
// http://www.blackbam.at/blackbams-blog/2011/06/09/wordpress-custom-external-authentication-loginlogout-php-script/
// this action is executed just before the invocation of the WordPress authentication process
function alogin_authentication() {

    // try to log into the external service or database with username and password
    $ext_auth = alogin_virtual_login($username,$password);

    // if external authentication was successful
    if($ext_auth) {
    // this will actually make the user authenticated as soon as the cookie is in the browser

        // you can redirect the authenticated user to the "logged-in-page"
share|improve this question
Can you explain why you need this? I am sure it can be done but I am also pretty sure there is a lot you will have to hack to make it work. It would help to know the why of what you are trying to achieve. – s_ha_dum Jun 11 '13 at 14:04
This is a requirement into a freelance project. – Mario Jun 13 '13 at 10:35
I assumed it was some kind of requirement, but why? Are you authenticating via some other database? Are you trying to create a "group" user? A temporary, or dynamically generated login? What? "Its a requirement" doesn't provide any useful information. – s_ha_dum Jun 13 '13 at 14:08
Oh, sorry, I didn't understand first time :) The 'virtual' user must be like any other user, but doe's not exist in database. This is required because it is necessary to have some 'superuser' or 'superadmin', hidden from other users. – Mario Jun 13 '13 at 15:29
Your coyness with the details is making this very difficult to interpret in any way other than the way @KenB has interpreted it. – s_ha_dum Jun 13 '13 at 20:02

Based on the latest details from Mario, this is meant as a back door and from his original question, the username and password would be encoded in the php file. Hard coded backdoors are big issues from a security perspective and should not be used. Passwords should be stored in encrypted databases so that they can be changed.

The other concern I have with this thread is that this is a freelance job and it seems that Mario plans to put code into the client site that will allow him ongoing and unrestricted access in the future, even after the client relationship ceases. A site should be able to severe ties with contractors by changing account passwords. Placing backdoors into code in this way is highly unethical and I would not consider doing business with coders that follow such a practice.

My bet, this is not a client requirement. It's a secret requirement of Mario's and if the client found out they would probably not be pleased. If it were a client requirement, the responsible answer is to talk them out of the requirement due to the inherent security flaws.

share|improve this answer
I am sorry because I asked such things here, I believed I can get my answer here, but instead I've got only questions and reproof. My objective was to find the solution in a fast way, not to convince you about my good intentions or about anything. Sorry again, for asking. – Mario Jun 17 '13 at 9:08
As I said, the prudent thing to do is discuss the requirement with the client and talk them out of it. Determine what problem they are attempting to solve by building a back door into their environment. It's a security risk to add it to the site. Presumably they would never know if they had been hacked using this backdoor and it would require code changes to update the password. Understand the problem the client is trying to solve and then propose more secure methods of solving it. – KenB Jun 20 '13 at 20:28

If you have server access you can install http://wp-cli.org/ and fiddle around with wordpress without creating a user.

share|improve this answer

Sounds like you're trying to build a back door into WordPress from a plugin. You can't circumvent the login like this otherwise everyone would be able to release a plugin and do it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.