I'm writing a web/db application. My clients would like authentication based on whether the user is logged into WordPress.

Assuming this application is hosted from within /wordpress I would like to be able to:

  1. Determine who, if anyone, is logged into WordPress

    Seems as if it should be possible via wp_get_current_user() but I can't find any documentation detailing which include files need to be included to make that work. Including /wp-includes/plugin.php and pluggable.php results in a class WP_User not found error from wp_get_current_user(). I presume some required include files are not included, but which?

  2. Read WordPress cookies

    Seems to require knowledge of the hash that was used when they were created - how is this gettable?

Additional Information: The clients are a group of over 300 artists who want

  • a website managed in WordPress and
  • a system to manage exhibition submissions,
  • a member database,
  • rotas,
  • user roles
  • catalogue production
  • detailed business rules/validation, permissions etc

It boils down to various m:n relationships. So a separate system providing 'club admin' alongside WordPress for the public-facing website, seemed a better fit than WordPress with endless plugins with uncertain futures. The group, understandably, desires SSO. OAuth or similar is not an option since we're restricted to a single shared hosting (cPanel) account.

UPDATE - simple solution found - see my answer below

  • I edited your question to make it a better fit (still, code and effort/try/fail is always appreciated). It's hard to understand why OAuth is not an option because of shared hosting? You can always include third party packages in custom plugins and there are plenty on GitHub (see Laravel, Symfony, etc.). Also, why don't you just check for the Cookie being set? You can fetch all config values from wp-config.php (or an .env file) and replicate the auth checks that WordPress performs against Cookies.
    – kaiser
    Mar 14, 2016 at 22:34
  • Thanks @kaiser for your edit. Think I misunderstood what is required for OAuth, but it's relatively complicated anyway since the system is likely to be managed in the longer term by people without much if any programming experience. If they decided to move hosts, the less setting up to do, the better. Checking the cookie seems easiest, however a (random?) string is appended to the wordpress_logged_in cookie name, and I don't see how anything in wp-config.php helps with getting its full name, after which the authenticated username could be extracted. Any advice appreciated. Thanks.
    – Gareth
    Mar 15, 2016 at 23:55
  • Well, depending on your deployment strategy, moving hosts can be easy. Taking a Docker setup for e.g. can easily be moved to a new host and then just get pulled up. Using Composer makes setting up the PHP part of an installations easy. Database migration basically is two mysql commands on the command line, which can be summed up in a bash script and used as deployment hook in pretty much every deployment service. Still they want something that only a professional can deliver.
    – kaiser
    Mar 16, 2016 at 0:56
  • @kaiser Please can you (or anyone else?) explain how to access the wordpress_logged_in_apparentlyRandomString cookie? I feel there should be a simple solution to this. What I really mean is how to determine what the apparentlyRandomString part is, then the cookie can be accessed as per usual :)
    – Gareth
    Mar 16, 2016 at 1:09
  • Look at the answer below.
    – kaiser
    Mar 16, 2016 at 1:09

2 Answers 2


Take a look at what wp_parse_auth_cookie() does. You can easily duplicate that given the fact that you have all the Cookie constants available.

Still, I'd highly advise against that. In your case, I'd try to integrate as far with WordPress as I can to avoid duplicating an authentication mechanism. You can always use any custom code (and connect to external Databases) by using plugins. Simply add the plugin header comment to the bootstrap process of your custom application and you are ready to run. You can also easily display data on custom admin pages or add page templates to the public facing site to handle data entries from there. Then restrict access to the application using is_user_logged_in() or exit( wp_redirect( home_url() ) ); in every other case.

Another option would be to build a custom application and integrate with WordPress via the REST API (available routes + addt. docs). Using WP as simply data provider backend then isn't that hard.

  • Thanks @kaiser - I wonder if my installation is corrupted or if I need to configure extra things despite no complaints from wp during installation. The apache2 error log shows undefined WPINC and ABSPATHWPINC - neither of which appear in wp-includes/default-constants.php - so I can't get wp_parse_auth_cookie() working - I have included the 'uses' and 'source' files suggested in developer.wordpress.org/reference/functions/…
    – Gareth
    Mar 16, 2016 at 2:05
  • ...I edited out the bit that said I'm new to wp development so apologies if this is all rather elementary to seasoned contributors...
    – Gareth
    Mar 16, 2016 at 2:05
  • Please just update your question whenever you make new things so we can see code + progress. Thanks.
    – kaiser
    Mar 16, 2016 at 2:06


If the application is hosted from within wordpress's root (eg. /var/www/html/wordpress), its scripts will be able to read cookies restricted to reading by scripts within the wordpress root path.

siteurl is a wordpress variable which, if you don't want to hardcode it, can be obtained dynamically from the wp_options table.

Wordpress stores the currently logged-in username in a cookie called wordpress_logged_in_<md5HashOfSiteURL> along with a hash of the wordpress username and password. This can be split/obtained by string manipulation as shown in the code below.

Thanks to @PeterTomasScott for this info: https://softwareengineering.stackexchange.com/questions/312861/why-do-some-web-apps-append-random-strings-to-cookie-names

This (PHP) seems to work as desired:

$hash=md5("http://localhost/wordpress"); // or get dynamically from db $wpcookie=$_COOKIE["wordpress_logged_in_$hash"]; $stop=strpos($wpcookie,"|"); $currentusername=substr($wpcookie,0,$stop);

The content of $wpcookie following the first "|" is a hash of the current user's username and password (from wp_users) which can be used for further security checks.

I abandoned a wordpress function-based approach since Apache was complaining about undefined WPxxx constants (so functions wouldn't work, and some include files further up the chain of include files wouldn't include) despite wp installing without complaint. I hope something is wrong with my installation, otherwise that's an awful lot of fiddling to achieve something that should be simple... no?

Thanks nonetheless to @kaiser for your help.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.