Intentionally Force Failed Login WordPress

Question

I'm trying to force the WordPress login function to fail on certain conditions. Basically, we have a situation where we have users that have allowed their accounts to expire in our membership environment. The idea is that if they try to login, it just fails their login because they won't be able to access anything anyhow so I figure we just let them know with a custom login_errors message.

The issue is that the user has to have a login error in order to make this happen (meaning they have to use an incorrect username/password combination). In this case, they would still have logins but they just don't have a valid membership to interact with the content on the site.

I'm intercepting the process using the wp_authenticate hook and I'm able to successfully grab the information from the user logging in but I can't seem to force it throw an error. If I return false or return new WP_Error() it doesn't work. If I change the credentials in the flow, that doesn't seem to matter either.

Any ideas on how to force it to fail the login and redirect to the login page with the new error message?

Answer 1

A long time since I last did this on a site, but this is the gist.

You want to hook into wp_authenticate_user which will fire after WP has tried to authenticate the user but before logging the user in.

You'll receive either a WP_User object or a WP_Error object and you should return either a WP_User object (if your own authentication check succeeds) or a WP_Error object (if your auth fails). Something like this should work:

function wpse_232915_authenticate_user( $user ) {

    /* already failed login attempt
       return existing error or you'll subvert the login process:
    */
    if ( is_wp_error( $user ) ) {
        return $user;
    }

    $failure = your_own_authentication_tests( $user->ID ); // test if the user should be allowed in by your own rules

    if ( $failure ) {
        return new WP_Error( 'wpse_232915_user_expired', 'Sorry, you have expired!' );
    }

    return $user;
}

add_filter( 'wp_authenticate_user', 'wpse_232915_authenticate_user' );

Depending on how complex your test is, you could return the WP_Error object from that function rather than true/false as I've assumed here.

I'm not handy enough with WP_Error to know whether you can chain the errors, or whether the login error notification box would be happy with that, but that's an improvement that might be worth looking into.