Is there a way for a WordPress plugin to authenticate a user for the current request?

My plan is to authenticate users via a HTTP header containing username and password. Then this information should be used to handle the current request as if this user would be logged in. However no session cookie or anything should be set, so that the authentication is only valid for the current request.

(I know of the security implications, they are taken care of)

The mechanism should work for normal pages, that render HTML and not be limitted to the JSON API.


My WordPress installation is not accessible from the internet, but reverse proxied from an application server. I configured some pages in WordPress to only be available for certain WordPress users.

Now I want to use the permissions used in WordPress with its users to determine what content can be accessed from the application server. The users in WordPress basically resemble the usergroups of the application server. That way I can use a full blown permission system in WordPress without needing to replicate the user database from the application server in the WordPress instance.

1 Answer 1


Yes, you can hook determine_current_user. This is how WordPress calls the existing code that processes authentication cookies:

add_filter( 'determine_current_user', 'wp_validate_auth_cookie'          );
add_filter( 'determine_current_user', 'wp_validate_logged_in_cookie', 20 );

e.g. see the implementations of those in wp-includes/pluggable.php. Your filter should return the user ID of the user you want to authenticate as once you've processed the headers.

That said I assume your application server has done the authentication, so you don't need to actually validate the password here: the username should be enough, provided there's no way for an external user to forge the authenticate-to-WordPress header (and get that through your reverse proxy).

  • Good point regarding the password. WordPress is not reachable from the internet, the header cannot be passed down. I thought of it as extra security, but I think I will use the username directly as you suggested which reduces the knowledge about WordPress in the application server. 👍 Commented Feb 25, 2019 at 13:55
  • two notes 1. It is hard to have too much security. Even on intranet you might have hostiles (most likely people that work there) 2. starting with WP 5.6 it seems like you can authenticated via basic authentication in the HTTP request (AKA application password) Commented Sep 23, 2021 at 7:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.