WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm manually creating users programmatically, and I want to sign in the newly created user. WP makes it easy to access the hashed password, but not the plaintext version. Is there a way to use wp_signon() without the plaintext password?

I found one person who claims to have done this here, but it didn't work for me.


share|improve this question
I think you can just assign the user object of the user you just created to the current_user global variable – onetrickpony May 28 '12 at 13:27
up vote 14 down vote accepted

wp_set_auth_cookie() will log a user in without having to know their password.

share|improve this answer
This worked great. However, when I use it, the conditional is_user_logged_in() doesn't seem to work. Do you know if it's looking at something different than the cookies? – emersonthis May 28 '12 at 13:44
@Emerson - what hook are you logging them in on? it has to be before headers are sent. also try to wp_set_current_user before logging them in. – Milo May 28 '12 at 13:47
I actually wasn't calling it from a hook at all. I just added wp_set_auth_cookie() into my signin function. I guess I need to rethink that. I'll also lookup wp_set_current_user and report back. Thank you very much for your help on this! – emersonthis May 28 '12 at 13:59
Well, is it possible to login a user without having his details exist in database? Just setting few cookies in browser through script is enough? Please let me know. – shasi kanth Feb 6 '14 at 9:10

The following code does the job for automatic login, without any password!

// Automatic login //
$username = "Admin";
$user = get_user_by('login', $username );

// Redirect URL //
if ( !is_wp_error( $user ) )
    wp_set_current_user ( $user->ID );
    wp_set_auth_cookie  ( $user->ID );

    $redirect_to = user_admin_url();
    wp_safe_redirect( $redirect_to );
share|improve this answer
Well, it works great. Just the username is enough, which is case insensitive. – shasi kanth Feb 6 '14 at 7:50
get_user_by() returns false on failure, so you should check for false instead of the WP_Error object – Brian Apr 14 at 20:41

I have found another solution here that uses a better approach (at least in my opinion...). No need to set any cookie, it uses the Wordpress API:

 * Programmatically logs a user in
 * @param string $username
 * @return bool True if the login was successful; false if it wasn't
    function programmatic_login( $username ) {
        if ( is_user_logged_in() ) {

    add_filter( 'authenticate', 'allow_programmatic_login', 10, 3 );    // hook in earlier than other callbacks to short-circuit them
    $user = wp_signon( array( 'user_login' => $username ) );
    remove_filter( 'authenticate', 'allow_programmatic_login', 10, 3 );

    if ( is_a( $user, 'WP_User' ) ) {
        wp_set_current_user( $user->ID, $user->user_login );

        if ( is_user_logged_in() ) {
            return true;

    return false;

  * An 'authenticate' filter callback that authenticates the user using only     the username.
  * To avoid potential security vulnerabilities, this should only be used in     the context of a programmatic login,
  * and unhooked immediately after it fires.
  * @param WP_User $user
  * @param string $username
  * @param string $password
  * @return bool|WP_User a WP_User object if the username matched an existing user, or false if it didn't
 function allow_programmatic_login( $user, $username, $password ) {
    return get_user_by( 'login', $username );

I think the code is self explanatory:

The filter searches for the WP_User object for the given username and returns it. A call to the function wp_set_current_user with the WP_User object returned by wp_signon, a check with the function is_user_logged_in to make sure your are logged in, and that's it!

A nice and clean piece of code in my opinion!

share|improve this answer

This works well for me:

  wp_set_auth_cookie($user->ID, true, false);
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.