Where is the function, that prevents non logged users, access restricted pages in Wordpress? I've looked in several files, but not found. I want to modify the way Wordpress authenticates to check cookies and also sessions.

Someone, help me?

  • Non-logged in users are already unable to access the admin area, hence why they're shown a login screen. Can you be clearer about what you're trying to accomplish and why?
    – Tom J Nowell
    Apr 1, 2016 at 17:00
  • @TomJNowell I think OP asking about which function authenticate user to modify it. But I think to broad to answer!
    – Sumit
    Apr 1, 2016 at 17:04
  • 1
    True, it could be about using sessions instead of cookies, or it could be about denying access to wp-admin so they can implement their own login form, or others, but best for the OP to clarify first :)
    – Tom J Nowell
    Apr 1, 2016 at 17:07
  • @TomJNowell, I have a database on another system with a huge list of users. I want to make with they can login in Wordpress. My main idea was to modify the way they are authenticated in Wordpress from cookies to session. It is possible? Apr 1, 2016 at 18:06

1 Answer 1


You will need to use the authenticate filter:


add_filter( 'authenticate', 'myplugin_auth_signon', 30, 3 );
function myplugin_auth_signon( $user, $username, $password ) {
     return $user;

Return a WP_Error object to indicate failure or an issue, or a WP_User object on success.

There are also 2 core functions hooked into that filter that will need removing named wp_authenticate_username_password and wp_authenticate_spam_check, these will need removing via the remove_filter function.

Once this is done, WordPress will rely on your own Auth system.


  • You will need to create and update WordPress users to match yours on login and when they're updated. A lot of code relies on the user table and the assumption of user meta, but you can set that meta and those users based on your database. Eliminating the user table entirely is not feasible
  • You'll be using WordPress' cookie based session system
  • If you want PHP sessions, that's an entirely new problem. WordPress doesn't use PHP sessions, and you'll have to write all of that code yourself. Keep in mind that PHP sessions don't behave well on a lot of managed hosts, and most plugins and themes don't use or respect them either. I do not see what advantages you would gain unless you have another system that depends on sessions

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.