When WordPress is loading and the theme is parsed, which file is loaded first? Is it one of the template hierarchy members or is it functions.php? Are there exceptions to the load order of files in the theme? Do you know where in the core-files (source code) this happens?

During my "investigation", I error-logged every FILE in the theme folder, and it seems that the entry point is functions.php.

Bonus question:

I want to verify user authentication and privileges in one place and not in the various members of the template hierarchy. Do you have an example of structured, OOP-solutions for this in a public WordPress plugin or theme?


The active theme's functions.php is the first theme file loaded, in the file wp-settings.php. All other theme files are loaded depending on the context of the request, which happens very late in the load process, after the user is authenticated, the request is parsed, and the query runs. Templates are for display, nothing belongs in a template that's not related to front end display.

Most of the authentication stuff happens in pluggable.php, which allows you to override the authentication functions. This is probably where you want to be looking if you want to customize the authentication process. The function wp_get_current_user is triggered from the wp class to kick off the process. There are also a few actions that are triggered in this process that let you run your own code and short-circuit the process, and are a much simpler and safer way to do your own auth stuff than fully overriding pluggable functions.

I suggest familiarizing yourself with the Action Reference to see the order in which things happen in the load process. Almost everything you do in WordPress will be hooked to an action to run at a specific time. I also suggest putting your code in a plugin or must-use plugin if you want it to be present regardless of selected theme.

As for the bonus question- I can't think of one off the top of my head, maybe I will think of something later...

  • Ya, i think wp_authenticate is the filter where one can override the auth process, but there is also a mess around the verify cookies functions... My concern is after that - the question is unclear. Oct 25 '15 at 22:29
  • Another option is to create a separate custom login area, use your own form and submit to your own handler using admin-ajax or admin-post, run whatever authentication code you need to run, then use wp_signon to log them in and set the proper cookies.
    – Milo
    Oct 26 '15 at 3:35
  • I do this on a site where users log in with an ID generated by another system. I connect the WordPress account to the other system by saving that other ID in user meta, and look them up that way to log them in.
    – Milo
    Oct 26 '15 at 3:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.