WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I let users to register in my page, however I want to improve the password security that is saved in the DB.

For this I need to find out which is the file that makes the query
where pass=pass and login=login

Which one is it? Thank you.

share|improve this question

wp_authenticate_username_password in wp-includes/user.php and wp_check_password in pluggable.php

I would advise against meddling with these though unless you're removing the wordpress user authentification and putting your own in, e.g. http://wordpress.org/extend/plugins/simple-ldap-login/. For the best part, not using the admin username, making the first account a non super admin, not using wp_ database prefix, putting salt values in wp-config.php and setting up your folder permissions/htaccess correctly would do you far more good.

If a hacker has access to your encrypted password hashes, you've already lost the battle.

share|improve this answer

WordPress uses phppass to store the passwords which is actually the blowfish variable key length cipher, if you are worried about blowfish being cracked you probably should not be using WordPress. If for some reason you dislike blowfish you can replace it, but improve it, that is highly unlikely.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.