I am trying to create my own login form for WordPress using wp-login.php as a template.

In the form that is used to collect login information from the user (lines 680 through 703 of wp-login.php), there doesn't seem to be any implementation of a nonce.

I have been told by quite a few people that I should always be using a nonce when collecting information from forms - but there is not a single reference to a nonce in this entire file - despite their being four fairly critical forms.

So - what am I missing?

I know that the login form uses a testcookie and that you create a securecookie when reading through the POST information - but does that somehow solve the security issue? Are there any good resources out there for understanding how secure cookies work in this instance?


using wp-login.php as a template.

is not a correct way to do that.


You'd better use the wp_login_form() function in a custom template.


And if you want to add an option to reset password you could do this :

add_action( 'login_form_middle', 'add_lost_password_link' );
function add_lost_password_link() {
return '<a href="/wp-login.php?action=lostpassword">Lost Password?</a>';


  • but if I use wp_login_form(), how will I handle password resets? – William Jun 25 '13 at 0:30
  • 1
    I've edited code. Actually this won't be problematic ;) – JMau Jun 25 '13 at 8:58
  • 1
    but with your solution, it would then utilize the wp-login.php page, correct? I am trying to avoid that because I want to make a page with different functionality - – William Jun 25 '13 at 15:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.