My client explicitly does not want to use 'multisite' wordpress option.
My client has a main site and 199 sub sites (other domains).
A user has usermeta with meta key: branch_id

As an example (completely made up names):
Main site: kero.com
Sub site: uka.com (and many others)

Both domains have SSL certificates.

The end goal is as following: When you log in to the main site (kero.com). I have build a plugin which checks which branch ID is attached to the user. It goes like this:

function myplugin_auth_signon( $username, $password ) {  
  $user = get_user_by('email', $username);      
  $user_id = $user->ID;
  $key = 'branch_id';
  $single = true;
  $branch = get_user_meta( $user_id, $key, $single );
  if($branch == 'number') {
    //magic happens here!
    $cookie = "cookie.txt";

    $postdata = "log=" . $username . "&pwd=" . $password . "&wp-submit=Log%20In&redirect_to=" . $url . "wp-admin/&testcookie=1";
    $ch = curl_init();
    curl_setopt ($ch, CURLOPT_URL, $url . "wp-login.php");

    curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
    curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv: Gecko/20070725 Firefox/");
    curl_setopt ($ch, CURLOPT_TIMEOUT, 60);
    curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1);
    curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 0);
    curl_setopt ($ch, CURLOPT_COOKIEJAR, $cookie);
    curl_setopt ($ch, CURLOPT_COOKIEFILE, $cookie);                
    curl_setopt ($ch, CURLOPT_REFERER, $url . "wp-login.php");

    curl_setopt ($ch, CURLOPT_POSTFIELDS, $postdata);
    curl_setopt ($ch, CURLOPT_POST, 1);
    $result = curl_exec ($ch);
    //This is from the answer of the link. On the end url the users get redirected from wp-admin to my-account
    header('location: ' . $url . 'wp-admin/'); 

    //after logging in redirect the user to uka.com/my-account

add_action( 'wp_authenticate', 'myplugin_auth_signon', 30, 2 );

So I build all kind of stuff, I used this link on the //magic happens here: Click here.

It does not work as intented. It keeps me on the main website, but when I click on 'store' it is in the sub site. When I go to my-account (where I should be logged in) i'm not logged in anymore.

I wrote some other code:

$response = wp_remote_post( $url, array(
        'method'      => 'POST',
        'timeout'     => 45,
        'redirection' => 5,
        'httpversion' => '1.0',
        'blocking'    => true,
        'headers'     => array(),
        'body'        => array(
            'username' => $username,
            'password' => $password
        'cookies'     => array()

I don't really know how to use this for my personal goal. I can echo the results, but then get a big array of headers etc. And when I surf to the subsite: I'm not logged in... So it just does not keep sessions/cookies.

TBH: I'm really a beginner on the whole session/cookie/security stuff. Most of the time I build in Wordpress or Laravel and most of the security stuff is already handled then.

Thanks everyone who is taking the time to read this.

UPDATE: Added extra cUrl code!

  • You should read about SSO concept. Maybe to use already existing like Google account?
    – kierzniak
    Commented Dec 16, 2017 at 18:16
  • you should add the full code here, giving us the link does not help in case you made an error
    – inarilo
    Commented Dec 16, 2017 at 22:34
  • Added the curl code!
    – Dennis86
    Commented Dec 17, 2017 at 12:53
  • I am using a User Session Synchroniser plugin right now: and it is almost working for my use case. I just need to find a hook to redirect to the other website when all sessions and cookies are loaded. wp_loaded unfortunately does not fit..
    – Dennis86
    Commented Dec 17, 2017 at 15:25
  • sitenote: i think you meant get_user_by('login', $username);
    – majick
    Commented Dec 19, 2017 at 10:42

3 Answers 3


You can not set cookies form site A that will be applicable on site B, therefor your "login by proxy" scheme will not work, and can not be made to work. In addition storing passwords in plain text is just a big no-no.

  • Thanks for the answer. Coincidence I just figured that out. That you can't do cookies cross domain. The 'storing' passwords in plain text is not what is happening here. The database does not store password in plain text, the action hook wp_authenticate makes username and password available to the developer to work with, in plain text. I have no idea why they chose that approach.
    – Dennis86
    Commented Dec 17, 2017 at 15:24

I think it would be possible to do it safely by doing something like this:

  1. Within the authenticate filter, send the CURL request as you are doing. The username / password would have to match (be synced) between site and subsite.
  2. Now logged in to the subsite, send a second CURL request to the subsite to get a temporary authentication token (generated by custom code on the subsite.)
  3. Put an iframe on the original site page (the one redirected to after logging in)... with the iframe src set to the subsite, with the temporary code (and username) sent in the querystring. (Alternatively just redirect to the subsite with the same URL.)
  4. Have custom code on the subsite to recognize the temporary authentication code (combined with username) and generate the authentication cookies that would be made in a normal login.

End result, the login cookie is set in the client's browser for the subsite as desired. :-)


For future reference I am answering my own question. Disclaimer: This was a freelance gig and had to be done in a X time frame. Which mean that this was the quickest AND simplest option.

What I did was:

  1. Installed the plugin https://wordpress.org/plugins/user-session-synchronizer/ - Give this guy some credit, this plugin is insanely good. Besides the insane fact that it's FREE...
  2. I hooked in on the wp_loaded hook and checked what branch ID the user had; The plugin I wrote had options with branch ID's and the urls. It So after checking what branch ID the user had: it checked which url corresponded with the branch ID.

Then echo'd

echo "<script>setTimeout(function() { parent.self.location='https://server.com'; }, 1500);</script>";

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.