1

I am trying to build a login where users with an account number as their username can login without a password or email.

When the user clicks login, if the username that has been input exists in the database and starts with a zero (Because I plan to make all these special accounts account numbers like 0612345), then WordPress shouldn’t bother to authenticate the password and should let the user into the account that matches that username.

I have no PHP experience but have tried to piece together code from other people's questions:

add_filter('authenticate', 'allow_certain_users', 9999, 3);
function allow_certain_users( $user, $username, $password) {
    // If the username starts with a zero, ignore whether the password input is correct
    if (substr($username, 0, 1) == "0") {
        $user = apply_filters('authenticate', null, $username, $password);
        return $user;
    }
    return $user;
}

To explain why, these account number users will have minimal capabilities so there won't be anything critical or personal that needs securing within each account. I would just like to avoid having to deal with the personal data of emails and passwords.

Any help appreciated!

5
  • hmmm, WP users still need an email, how are you planning to avoid that hard requirement? Note that this will have security consequences for your site, even with limited abilities for those users, and this does not sidestep GDPR and other data regulations around personal data
    – Tom J Nowell
    Nov 16 '20 at 15:11
  • @TomJNowell Basically by using nonsense emails the user will never see or need to have anything to do with. What personal data issues do you think only having an account number will cause?
    – Troas
    Nov 16 '20 at 15:15
  • Anything your users have attached to them basically, including the identifier itself
    – Tom J Nowell
    Nov 16 '20 at 16:34
  • Sorry, do you mean cookies? The account number won't be used anywhere else except for a spreadsheet where each user can be identified for support.
    – Troas
    Nov 17 '20 at 9:20
  • Then that account ID is personally identifying information, because it can be used to identify a person ( via a spreadsheet at support )
    – Tom J Nowell
    Nov 17 '20 at 11:33
1

You can use the wp_create_user function to create users without a defined email

To log in without a password you can see this question

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.