I am trying to create my own login form for WordPress using wp-login.php as a template.

In the form that is used to collect login information from the user (lines 680 through 703 of wp-login.php), there doesn't seem to be any implementation of a nonce.

I have been told by quite a few people that I should always be using a nonce when collecting information from forms - but there is not a single reference to a nonce in this entire file - despite their being four fairly critical forms.

So - what am I missing?

I know that the login form uses a testcookie and that you create a securecookie when reading through the POST information - but does that somehow solve the security issue? Are there any good resources out there for understanding how secure cookies work in this instance?

1 Answer 1


using wp-login.php as a template.

is not a correct way to do that.


You'd better use the wp_login_form() function in a custom template.


And if you want to add an option to reset password you could do this :

add_action( 'login_form_middle', 'add_lost_password_link' );
function add_lost_password_link() {
return '<a href="/wp-login.php?action=lostpassword">Lost Password?</a>';


  • but if I use wp_login_form(), how will I handle password resets?
    – William
    Jun 25, 2013 at 0:30
  • 1
    I've edited code. Actually this won't be problematic ;)
    – JMau
    Jun 25, 2013 at 8:58
  • 1
    but with your solution, it would then utilize the wp-login.php page, correct? I am trying to avoid that because I want to make a page with different functionality -
    – William
    Jun 25, 2013 at 15:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.