WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am going to enhance my WordPress authentication page. My idea is that simply adding an extra field into the login page. The extra field will require user to enter personal identification code (4 to 8 digit).

I have changed the login page layout in "wp-login.php" and added extra column for storing personal identification code in MySQL database.

However, I don't know which part of coding is used to verify the password as I want to refer to the existing coding.

Could you help me?

share|improve this question

Welcome to WordPress SE :D.

First of all I would advise against editing the core files. It will be overwritten when you next update WordPress. And you should update WordPress, because it will often include security updates. (It's recently been reported that there has been a spate of attacks on sites using outdated WordPress versions)

You can do all of what you plan to do using hooks.

To create an extra field you'll want to use the login_form action hook:

function my_added_login_field(){
    //Output your HTML
        <label for="my_extra_field">My extra field<br>
        <input type="text" tabindex="20" size="20" value="" class="input" id="my_extra_field" name="my_extra_field_name"></label>

Next we need to verify that what they entered into the field matched what you have stored. In the following code, I've assumed you've stored the identification code as a user meta value with meta key my_ident_code. You should do this rather than create your own column!. See the Codex pages for

To verify a users you can use the authenticate filter. This passes the entered username and password. If the identification code is correct, return null to allow WordPress to verify the password and username. If it is not correct, remove the WordPress' authentication and return an error. This forces the user back to the log-in page, where they'll see the error displayed.

add_filter( 'authenticate', 'my_custom_authenticate', 10, 3 );
function my_custom_authenticate( $user, $username, $password ){
    //Get POSTED value
    $my_value = $_POST['my_extra_field_name'];

    //Get user object
    $user = get_user_by('login', $username );

    //Get stored value
        $stored_value = get_user_meta($user->ID, 'my_ident_code', true);

    if(!$user || empty($my_value) || $my_value !=$stored_value){
        //User note found, or no value entered or doesn't match stored value - don't proceed.
            remove_action('authenticate', 'wp_authenticate_username_password', 20);
            remove_action('authenticate', 'wp_authenticate_email_password', 20); 

        //Create an error to return to user
            $user = new WP_Error( 'denied', __("<strong>ERROR</strong>: You're unique identifier was invalid.") );

    //Make sure you return null 
    return null;
share|improve this answer
It is extremely useful. Thanks so much – nomall Mar 17 '12 at 13:52

This answer for Reference purpose only. Don't hard code with WP core files please.

Password verification Process.


Line number 250 - 257

function CheckPassword($password, $stored_hash)
        $hash = $this->crypt_private($password, $stored_hash);
        if ($hash[0] == '*')
            $hash = crypt($password, $stored_hash);

        return $hash == $stored_hash;


share|improve this answer
You shouldn't be editing the core files for something like this. It's unnecessary and potentially dangerous. – Stephen Harris Mar 17 '12 at 11:41
Yes. But he needs to know about password check. Then only i showed the function. :( – Manimaran Mar 17 '12 at 11:45
He told, "I want to refer to the existing coding.". – Manimaran Mar 17 '12 at 11:46
sorry, the downvote was a bit harsh of me. Unfortunately I can't de-vote it unless your answer is edited. – Stephen Harris Mar 17 '12 at 12:05
After one year i will come to this site. But this down vote reduces my effort. :( Thanks Anyway. – Manimaran Mar 17 '12 at 12:27

If editing all that code seems a little daunting there is a good plugin for this:

Cimy Extra Fields

Or you could consider using Theme My login which can do this, but it takes some coding. It also adds quite a bit of extra functionality. You can happily use these two plugins together.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.