Very odd problem with wp_signon

Below I pass a users credentials to wp_check_password and it returns true proving the password is correct.... however when i try to signin it return wp_error with
"ERROR: The password you entered for the username XXXXXXX is incorrect."

Please, can anybody explain why this is? and how to fix?

$password = "vdouW#DswYMH"
$hashed = wp_hash_password($password);   //$P$Bydu8uFLe8CFXmtGjA71Tfv8Tyo7nH0

if (wp_check_password($password,$hashed,$user->data->ID)) {
    echo "Yes, password correct".
    $creds['user_login'] = $user->data->user_login;
    $creds['user_password'] = $password;
    $creds['remember'] = false;
    $user2 = wp_signon( $creds, true );

    if ( is_wp_error($user2) )
        echo $user2->get_error_message().' - '.$hashed;
        echo 'Success<br/>';
  • have you done a sanity check and verified that the pw you get back from wp_hash_password() actually matches the pw in the database?
    – Milo
    Jul 11, 2011 at 15:33
  • Yes, I've checked them multiple times... exactly the same...
    – user608207
    Jul 11, 2011 at 19:39

2 Answers 2


Pretty sure wp_check_password() is not meant to be used the way you're using it.

From the looks of the documentation, and as far as I can tell by looking at the source, this function is only meant to compare the plaintext password you provide against the hash you provide--not to check whether a particular user's stored password matches the passed creds. (The user id param is misleading--it has to do with converting a user's existing password form one kind of hash to another when necessary, I believe. But I'm not 100% sure).

In any case, you don't need to do any of this checking manually. The wp_signon() function will itself will check the creds, and if they're correct it'll log the user in and pass back a valid user object. If the creds aren't right, it'll pass back an error object.


What function are you adding your users with? I just ran into a fail in wp_update_user (3.1), resulting in wp_signon failing because password had been stored double-hashed. Using wp_insert_user seems to operate correctly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.