I've recently integrated WordPress to my website and I've been trying to find out the correct way to replace Wordpress' authentication system with the one on my website.

My website already has a user database, and the user is authenticated through PHP sessions.

My goal is simply to remove WordPress' integrated register/login form, and make it so users already logged in to my website have access to Wordpress functionalities simply through session_start() (and privileges check). I wouldn't be using Wordpress' user database.

Most informations I found on this topic are mostly about integrating an external database to Wordpress, like the plugin External Database Authentication Reloaded, but very few on how to actually change the way WordPress checks if user is logged in before granting him access.

I would like to properly understand how to allow users logged in my website to get the same privileges as if they were also logged into my WordPress (by checking if $_SESSION['simple_auth'] == true)

I understand that this question has already been asked; I've done some research, but I'm mostly looking for advice on how to do this (or why I should not do this), and some guidelines that might help me.

  • Can you share your research and what you've done/found so far and any specific questions you have? No point us spending time telling you what you already know!
    – Tim Malone
    May 3, 2016 at 21:27
  • Sure, I'm going to update my post with theses informations.
    – apatik
    May 3, 2016 at 21:39
  • I am well versed with WP authentication. My first comment is that php sessions is not advisable - takes work to make it work on multiple servers and to make it secure. My question is how would WP integrate with your custom auth? For example would users have to authenticate to your system before accessing WP; or maybe you want to change WP auth form/process to go to your system to authenticate.
    – user42826
    May 4, 2016 at 16:51
  • Also your custom auth would need to pass information to WP: username, email, name, WP role. Can that be done and how?
    – user42826
    May 4, 2016 at 16:58
  • my website integrates a login/register form, and users' informations are stored in a table (similar to WP's user table), as for WP's own login/register pages I would simply redirect the user to my own pages. Passing the informations to WP should be possible, I can store the user's info into $_SESSION but the tough part is implementing all this into WP. I suppose I would have to go through every file and manually do it, hoping nothing breaks..
    – apatik
    May 4, 2016 at 17:09

3 Answers 3


WordPress's authentication system is made up of pluggable functions, which means that you can write a plugin that has a function named, say, wp_authenticate(), and your site will use your wp_authenticate() function instead of the native WordPress one.

Your comment about is_user_logged_in() (on your original post) is obviated by the fact that is_user_logged_in() calls the pluggable wp_get_current_user(), meaning that you can write your own wp_get_current_user() and control is_user_logged_in() that way.

So you should be able to write an authentication system for WordPress that will use your pre-existing user database.


  • Thanks for your answer, that is indeed almost exactly how I did. Except I recoded instead is_user_logged_in() insead of wp_get_current_user() but maybe I should have done as you said, with the second one (I'm going to check everything out anyways), I'm gonna have to include it as a plugin once I figured out the best way to set this up.
    – apatik
    May 5, 2016 at 19:29
  • That should work just fine, since is_user_logged_in() is a pluggable function as well.
    – Pat J
    May 5, 2016 at 19:31
  • However working on pluggable functions is not enough :/ some files in wp-include for instance have to be modified aswell to adjust the script for the php sessions (for instance, when a comment is posted, the session has to be started when WP double checks the user's permissions, otherwise the $_SESSION variables are null). Do plugins allow me to modify theses aswell ?
    – apatik
    May 5, 2016 at 19:46
  • You should never modify core files. There should be action or filter hooks that will allow you to do what you need. If you're not familiar with WordPress' hook system, have a look at the Plugin API section of the Codex.
    – Pat J
    May 5, 2016 at 21:01

Is using Auth0 (http://www.auth0.com) maybe an option for you? They have a very good Wordpress plugin.

I think you could integrate your system and do a Single Sign On (SSO) using the plugin.

I think it's a better option for you to do some stuff on your system to integrate (since you know the system and can probably be more productive), using this https://auth0.com/docs/oauth-web-protocol and let the plugin take care of everything on Wordpress.

  • Thanks for your answer, I checked auth0 but if I understand it right it would make log in through a 3rd party app that merges both my website and WordPress' authentication system. I'm going to keep it on the side for now, as I would prefere building it manually. Thanks again
    – apatik
    May 4, 2016 at 0:07

Here is an example authentication plugin. It will pull information from your php session variables. This is how to use it:

  1. save it into a file mycustom-auth.php
  2. modify the constants near the top of the class
  3. put it into wp-content/plugins/mycustom_auth or wp-content/mu-plugins
  4. enable it in wp-admin
  5. log out of WP and log in again. You should see one extra line in the WP login form to take you to your custom authenticator. Click on it, then return to WP to see if you are logged in

   Plugin Name: mycustom Authenticator
   Description: authenticates against custom authenticator which uses php sessions
   Version: 1.0

new mycustom_auth();
class mycustom_auth{
    const AUTH_URL = 'http://domain.com/mylogin.php'; // custom auth url
    const USERNAME = "username"; // php session variable for username
    const EMAIL = "email"; // php session variable for email addreess
    const FIRSTNAME = "first"; // php session variable for firstname - optional
    const LASTNAME = "last"; // php session variable for lastname - optional

    function mycustom_auth() {
        add_filter('authenticate', array($this,'authenticate'), 20, 3);
        add_action('login_form', array($this,'login_form'));
        add_action('login_head', array($this,'login_head'));

        //remove_filter('authenticate', 'wp_authenticate_username_password', 20, 3);

    function authenticate($user, $username, $password) {
        if ( is_a($user, 'WP_User') ) {
            return $user;
        $uid = $_SESSION[mycustom_auth::USERNAME];
        $email = $_SESSION[mycustom_auth::EMAIL];
        $firstname = $_SESSION[mycustom_auth::FIRSTNAME];
        $lastname = $_SESSION[mycustom_auth::LASTNAME];
        if (!isset($_SESSION[mycustom_auth::USERNAME]) || empty($uid)) {
            return new WP_Error('invalid_username', __('Custom Login Error: php session not set.'));
        $user = get_user_by( 'login', $uid); // could get by email address instead
        if (!$user) {
            $user = $this->create_user($uid,$email,$firstname,$lastname);
            if (!$user) {
                return new WP_Error('invalid_username', __('Custom Login Error: You are not currently registered user for this site.'));
        return new WP_User($user->ID);

    function create_user($username,$email,$firstname,$lastname) {
        if ( empty($username) || empty($email)) return null;
        $user_id = wp_insert_user(array('user_login'=>$username,
        $user = new WP_User($user_id);
        return $user;

    function login_form () {
        echo '' . __('Login with Custom', 'custom_login') . '

'; } function login_head() { // put custom styling here } } ?>
  • Thanks for your answer, this is a good enough model for me to work around, I'm going to code and try things out this evening and bump you up if things go well, or if it doesn't :/ Thanks for your help !
    – apatik
    May 5, 2016 at 19:39
  • Do you know why defining a pluggable function such as is_user_logged_in() inside a class won't work, while outside it will ? For instance in your code, if I were to replace function authenticate(...) by is_user_logged_in it wouldn't be executed.
    – apatik
    May 6, 2016 at 17:05
  • It wouldnt make sense to remove the authenticate function. Just use my plugin as is with those configuration parameters updated at top. If you want to see if the plugin works, in authenticate set $uid to a known user. Warning you will be automatically logged into WP as that user immeditately.
    – user42826
    May 6, 2016 at 18:09
  • No no, it was just an exemple of what my code looks like, like if is_user_logged_in was where authenticate is in your script.
    – apatik
    May 6, 2016 at 18:19
  • This hook is "authenticate" which means that it is loaded very early because the user is not even logged in yet. A lot of WP APIs will not work at this stage - is_us_logged_in() is most likely one of them. You can view the main hooks and execution order
    – user42826
    May 6, 2016 at 18:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.