WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to create my own login form for WordPress using wp-login.php as a template.

In the form that is used to collect login information from the user (lines 680 through 703 of wp-login.php), there doesn't seem to be any implementation of a nonce.

I have been told by quite a few people that I should always be using a nonce when collecting information from forms - but there is not a single reference to a nonce in this entire file - despite their being four fairly critical forms.

So - what am I missing?

I know that the login form uses a testcookie and that you create a securecookie when reading through the POST information - but does that somehow solve the security issue? Are there any good resources out there for understanding how secure cookies work in this instance?

share|improve this question
up vote 2 down vote accepted

using wp-login.php as a template.

is not a correct way to do that.


You'd better use the wp_login_form() function in a custom template.


And if you want to add an option to reset password you could do this :

add_action( 'login_form_middle', 'add_lost_password_link' );
function add_lost_password_link() {
return '<a href="/wp-login.php?action=lostpassword">Lost Password?</a>';


share|improve this answer
but if I use wp_login_form(), how will I handle password resets? – William Jun 25 '13 at 0:30
I've edited code. Actually this won't be problematic ;) – JMau Jun 25 '13 at 8:58
Perfect - thank you! – William Jun 25 '13 at 14:54
but with your solution, it would then utilize the wp-login.php page, correct? I am trying to avoid that because I want to make a page with different functionality - – William Jun 25 '13 at 15:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.