I use form to send POST request to a page and to login user with wp_signon() in order to authenticate user to my wordpress installation as described in WP documentation:

$creds = array();
$creds['user_login'] = $_POST["user-login"];
$creds['user_password'] = $_POST["user-password"];
$creds['remember'] = true;

$user = wp_signon( $creds, false );

After this little piece of code I'm checking if user was logged in:

if ( is_user_logged_in() ) { echo "SUCCESS"; } else { echo "FAIL!"; }

But I got FAIL! all the time. Then after sniffing around I found this little trick:

wp_set_current_user( $user );
if ( is_user_logged_in() ) { echo "SUCCESS"; } else { echo "FAIL!"; }

I've got SUCCESS on this one but when I leave this page I got FAIL again and again.

Can anyone explain me how to login user with wp_signon() without logging her out after page is changed or reloaded or whatever.

I've got desirable result when I go to /wp_admin and login with WP's default login form. I can navigate through every page of my WP site remaining logged-in all the time. But when I try to do this outside the default form I FAIL.

Guide me! PLEASE!

  • is your site have SSL, i mean your site's url scheme http or https ??
    – Anjum
    Commented Sep 24, 2013 at 18:26
  • @Anjum actually I store it on my localhost with MAMP ... so my answer is I don't know ))
    – LoomyBear
    Commented Sep 24, 2013 at 18:44
  • can you tell me how do you access your login page i mean your login page url, http://localhost/login-page/ or https://localhost/login-page/ ?
    – Anjum
    Commented Sep 24, 2013 at 18:47
  • please post your custom login form code here, so ..
    – Anjum
    Commented Sep 24, 2013 at 18:49
  • @Anjum I use just http://localhost:8888/registration/ but if you try to hint on wp_signon( $user, secure:true/false ) I've tried both and it didn't work. Anyway thanks.
    – LoomyBear
    Commented Sep 24, 2013 at 18:54

2 Answers 2


finally this is working for me on my local WP installation after replacing - with _ from input attribute name and using full php start tags <?php instead of <? the final code is here copy and paste into your template.

<?php if ( isset($_POST["user_email"]) && isset($_POST["user_password"]) ) {

$user_login     = esc_attr($_POST["user_email"]);
$user_password  = esc_attr($_POST["user_password"]);
$user_email     = esc_attr($_POST["user_email"]);

$user_data = array(
    'user_login'    =>      $user_login,
    'user_pass'     =>      $user_password,
    'user_email'    =>      $user_email,
    'role'          =>      'student'

// Inserting new user to the db
//wp_insert_user( $user_data );

$creds = array();
$creds['user_login'] = $user_login;
$creds['user_password'] = $user_password;
$creds['remember'] = true;

$user = wp_signon( $creds, false );

$userID = $user->ID;

wp_set_current_user( $userID, $user_login );
wp_set_auth_cookie( $userID, true, false );
do_action( 'wp_login', $user_login );


if ( is_user_logged_in() ) : echo 'SUCCESS'; ?>
<h1>Html for logged in user </h1>
<?php else : echo 'FAIL!'; ?>
<form id="user-credentials" method="post" action="<?php the_permalink(); ?>">
    <p><input name="user_email" type="text" placeholder="Email" /></p>
    <p><input name="user_password" type="password" placeholder="Password" /></p>
    <p><input type="submit" class="button blue size-s" value="Submit" /></p>
<?php endif; ?>
  • It keeps you logged in when you go to a page different from the one with the form? where wp_set_current_user(); is set?
    – LoomyBear
    Commented Sep 24, 2013 at 20:01
  • yes it's working fine for me, check your browser's cookie settings
    – Anjum
    Commented Sep 24, 2013 at 20:32
  • I've checked cookies in all the browsers. It is enabled everywhere. When I use this code it logins user only when form sends POST request. When the page is reloaded without sending anything to itself no one is logged in. I tried global $current_user; var_dump($current_user); and I got user info dumped only when the POST was sent otherwise it returns object(WP_User)#206 (7) { ["data"]=> NULL ["ID"]=> int(0) ...
    – LoomyBear
    Commented Sep 24, 2013 at 20:48
  • also when I login through default WP login form with the same user I've got $current_user var_dumped correctly in both cases. What is wrong with me??!!
    – LoomyBear
    Commented Sep 24, 2013 at 20:49
  • are you calling both wp_insert_user() and wp_signon() on each request? if yes try to comment out wp_insert_user() and then login to see the result.
    – Anjum
    Commented Sep 24, 2013 at 21:03

If your password includes the # and/or @ characters, you need to urlencode before sending in the form, and then urldecode before setting the credentials in wp_signon.

The url encoding for @ is %40, # is %23 and ! is %21

if your password is mY!p@ssWord# then should be URL encoded before POSTING to mY%21p%40ssWord%23, then URL decoded before setting the credentials for wp_signon

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.