I'm adding a modal login to my theme.
The most direct route is to create a template and include
wp_login_form(); in it. This will load the core login that can be customized a bit later, using CSS or jQuery.
However it requires the page to reload to verify the credentials. My thought was to send the username and the hashed password using an AJAX request, and sign the user in via
Now my questions are:
- Is it safe to do this? WordPress itself sends the password to server in some way, but I'm not sure this is it.
- If it's okay to do this, should I use
admin-ajax? or can the REST-API handle the login too?
- If all of the above are fine, then one final question. Is
wp_signon()the proper function for login? I thought
wp_set_auth_cookie()might come in handy too.