To implement custom user login functionality outside of the wp-admin area, wp_signon() function is the way to go. This function accepts an array which may contain the "remember" key with a boolean value to determine if the user shall stay logged in or not during the following 14 days.

I am using wp_signon() with remember set to true in a custom login implementation, as follows:

// $args['...'] = ...

$args['remember'] = true;
$user = wp_signon($args, is_ssl());

    // ...
    // ...

The sign-on process itself is working perfectly fine, but once I close the browser and open it again, there is no "remember" going on anywhere, the user appears as unauthenticated.

I did not find any documentation related with how this remember session feature is supposed to work from a developers point of view.

The generated cookies are:

enter image description here

enter image description here

From the docs: (see docs)

On login, WordPress uses the wordpress_[hash] cookie to store your authentication details. Its use is limited to the Administration Screen area, /wp-admin/

I do not understand this. Can someone provide a more detailed explanation please? The last part makes me think that this remember-me feature has been designed with the wp-admin area in mind, not the front. And maybe that's why it's not working.

After login, WordPress sets the wordpress_logged_in_[hash] cookie, which indicates when you’re logged in, and who you are, for most interface use.

This is quite understandable. But I am still confused anyways.

I noted that the expiration date does not contain a date. It says: "session". Should it not contain a future date instead?

So my question would be:

How can I handle autologin if the remember key was provided with wp_signon()? Do I need to check for it manually if I want to use it out of the wp-admin area or is this supposed to work out of the box thanks to wp-load.php?

What have I done to try to solve the mystery:

Extend the cookie lifetime:

function long_live_the_auth_cookie($expirein){
    return 31556926; // 1 year in seconds
add_filter('auth_cookie_expiration', 'long_live_the_auth_cookie');

Test in multiple browsers and devices to make sure it's not a browser or device specific issue.

Did I think of my own solution?:

Yes. To implement the remember-me functionality with custom code and just ignore the WP way, since WP user features seem to be only focused on the back-end. But I think this is too extreme, and the thing is that I am just missing what is really going on with those cookies and how to use them for my purpose.

  • In what file and hook (if any) did you put your wp_signon() code? What is the login process; is it like, user filled in the login form, then after successful login, your code redirects the user to somewhere?
    – Sally CJ
    Commented Mar 30, 2021 at 22:49
  • @Sally CJ, It is actually inside a method of a class. The method is attached to the init hook. User fills in the form and if the method detects the user input it handles the login and redirects afterwards. Thanks for your attention. Commented Mar 30, 2021 at 22:55

1 Answer 1


wp_signon() actually already calls wp_set_auth_cookie() which is the function that sets the "remember me" cookie, hence you don't need to manually call that function.

And that (wp_set_auth_cookie($user->ID)) is actually the problem in your code, because it's overwriting the "remember me" cookie that was already set.

  • 1
    Thank you for your time and help. Commented Mar 31, 2021 at 5:46
  • 1
    Foro future readers: You want to use wp_set_auth_cookie() and not wp_signon() when you want to force a user login without password. Also, you may need to call wp_set_current_user() depending on when you do the wp_signon() and if you are or are not redirecting the user afterwards. Commented Mar 31, 2021 at 7:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.