I have no HTTPS, and I would not like to use it yet on my blog. However, I need a way to secure my login page, so I want to encrypt the password with RSA before it gets sent. As I was not able to find a recent plugin, I need to do it myself. Where is the form so I can add javascript to encrypt, and where is the query so I can decrypt it?

  • stupid idea which show a total lack of understanding how SSL works and what are the weak security points in wordpress authentication scheme. In short it is totally not enough to "protect" your login, and your suggested protection do not actually protect even the login. – Mark Kaplun Jul 12 '17 at 3:22
  • I ended up choosing to use Cloudflare SSL, but I believe that if implemented properly, it should work. The login is encrypted before it leaves the computer, so if someone were to intercept it, it would be encrypted. – NerdOfLinux Jul 14 '17 at 5:35
  • no! reinventing protocols that people spent literally years inventing and ironing out the bugs is unlikely to end well. you are unlikely to even know what are the threat model https protects again (nothing personal, probably most of security people do not know as well) – Mark Kaplun Jul 14 '17 at 6:51

The hook you will probably be most interesting in is wp_authenticate.

Codex: This action is located inside of wp_signon. In contrast to the wp_login action, it is executed before the WordPress authentication process.

That hook and wp-signon are defined in wp-incldues/user.php line 10

But wp-includes/pluggable.php has wp_authenticate() and it can be overridden. It also provides a hook, authenticate.

The Form

The log in form (the form itself) is defined in wp-includes/general-template.php line 402

You can hook the default $args with login_form_defaults filter hook defined on line 431

The default $args for the form:

 $defaults = array(
                    'echo' => true,
                    // Default 'redirect' value takes the user back to the request URI.
                    'redirect' => ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'],
                    'form_id' => 'loginform',
                    'label_username' => __( 'Username or Email Address' ),
                    'label_password' => __( 'Password' ),
                    'label_remember' => __( 'Remember Me' ),
                    'label_log_in' => __( 'Log In' ),
                    'id_username' => 'user_login',
                    'id_password' => 'user_pass',
                    'id_remember' => 'rememberme',
                    'id_submit' => 'wp-submit',
                    'remember' => true,
                    'value_username' => '',
                    // Set 'value_remember' to true to default the "Remember me" checkbox to checked.
                    'value_remember' => false,

With root/wp-login.php

You can enqueue scripts into the head via the action hook do_action( 'login_enqueue_scripts' ); on line 90


There are other internal functions, like wp_authenticate_username_password($user, $username, $password) that follows wp_signon on user.php, that may be expecting or passing a text password.

A note on $password param in Codex of the wp_authenticate_user filter found in wp_authenticate_username_password:

$password (string) (optional) The user's password (plain text).

Hopefully wp_signon mentioned off the top can satisfy what you're after.

  • I will try it out as soon as I get a chance. I plan on decrypting it before any other functions, so there should be no problem. – NerdOfLinux Jul 12 '17 at 3:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.