Tag Info

New answers tagged


What you are trying to do is not very secure. You have to remember that there is no such thing as logged-in session on the internet, and authentication has to be done with every http request being send. The authentication cookie, while not carrying the password itself in simple plain text, can be used whenever anyone wants to "login" to your site, even after ...


To further Dan's answer, in order to properly form a login or logout link, WordPress provides you two functions; wp_login_url() and wp_logout_url() - both of which generate a URL with a nonce for you. There's actually a further helper function, wp_loginout() which provides a log in link if the user is logged and and a log out link if the user is logged in. ...


This happens because of a missing nonce parameter in the URL. Every WordPress action, including login/logout, validates the nonce first, to make sure the request comes from a known source.

Top 50 recent answers are included