0

I've been looking for this method for weeks, but still can't find it. There are so many sites that discuss how to create a custom login page, but they don't cover how to block a specific id like the one I was looking for.

The algorithm is as below:

first I will determine the user id number that I will block via code in php.

On the front end page, the user will input their username and password. Then when they click the login button, wordpress does not immediately check the compatibility between the user's username and password.

Wordpress will first check the id of the username that has been entered by the user. If it turns out that the username has the same ID as the ID I blocked, an error message will appear and the user cannot log in, but if the username does not have the same ID as the ID I blocked, then the user can login.

I hope you guys can help. Thank you in advance

2 Answers 2

0

You can add a low priority authenticate hook that runs after all the other hooks and rejects authentication for a specific user ID:

function wpse_384212_ban_user_id( $user, $username, $password ) {
    // At this point $user is either a WP_User object if they've successfully logged in,
    // or null or a WP_Error if they haven't. We want to reject users by ID.

    if ( $user instanceof WP_User ) {
        // This is a successfully authenticated user. Check their ID.
        $banned_user_ids = array( 3, 6, 10 ); // could also store these in a site option

        if ( in_array( $user->ID, $banned_user_ids ) ) {
            return new WP_Error( 'user_banned', 'You are banned' );
        }
    }

    // Else return the user or error from previous authentication filters
    return $user;
}

add_filter( 'authenticate', 'wpse_384212_ban_user_id', 999, 3 );

This rejects users who have otherwise logged in successfully. If you wanted to reject them whether they managed to log in or not, you'll need to look up the user to fetch their ID for the extra check:

function wpse_384212_ban_user_id( $user, $username, $password ) {
    // At this point $user is either a WP_User object if they've successfully logged in,
    // or null or a WP_Error if they haven't. We want to reject users by ID.
    $banned_user_ids = array( 3, 6, 10 ); // could also store these in a site option

    if ( $user instanceof WP_User ) {
        // This is a successfully authenticated user. Check their ID.

        if ( in_array( $user->ID, $banned_user_ids ) ) {
            return new WP_Error( 'user_banned', 'You are banned' );
        }
    } elseif ($username) {
        // Unsuccessful login but we have a username.
        // Look up the user by username or email to see if they are a banned user
        $login_user = get_user_by( 'login', $username );
        if ( ! $login_user && is_email( $username ) ) {
            $login_user = get_user_by( 'email', $username );
        }
        if ( $login_user instanceof WP_User ) {
            // This was a failed login for a valid user. Check the user's ID            
            if ( in_array( $login_user->ID, $banned_user_ids ) ) {
                return new WP_Error( 'user_banned', 'You are banned' );
            }
        }
    }

    // Else return the user or error from previous authentication filters
    return $user;
}

add_filter( 'authenticate', 'wpse_384212_ban_user_id', 999, 3 );

If this is a multisite then these would need to go in a mu-plugin.

3
  • thanks, it worked. But I asked about the ID. maybe the result will be the same. But I want in the if the condition is the ID of the doctor_evil. For example, I block ID = 3,6, and 10. Then a user inputs the name doctor_evil. Then the program will check for the ID of doctor_evil first, then after the ID of doctor_evil is known, then enter the if condition. Then the condition in if is the ID that I specify to block == ID of the user input
    – Ari
    Feb 28, 2021 at 14:11
  • Oh OK, apologies for misunderstanding. It’s easy to modify to reject a successful log in user by ID so I’ll do that in a bit but would need extra code to show the user a ban too if the password is wrong.
    – Rup
    Feb 28, 2021 at 14:14
  • it's no problem. I'll waiting for your complete code.
    – Ari
    Feb 28, 2021 at 14:28
0

There is a simple plugin which you could use to lock user account and it's FREE. https://wordpress.org/plugins/lock-user-account/

Simply works great!

  • Install and activate the plugin
  • Navigate to Users Page (From WP Dashboard)
  • Select the specific user(s) you want to lock
  • Choose 'lock' option from the 'Bulk action' dropdown
  • That's it!

enter image description here

enter image description here

2
  • thank you for your answer. I appreciate your answer. But I'm not looking for a plugin because there are so many plugins that can do this. I'm looking for a syntax that I can add to my custom login page.
    – Ari
    Feb 28, 2021 at 11:16
  • Maybe you can download the plugin and study it's codebase. Pretty simple. If still confusing let me know I'll try to explain.
    – Arnob
    Mar 1, 2021 at 13:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.