I have a sub-domain which I'm trying to restrict to authenticated Wordpress users but the authentication isn't working. I've tried the following code:

global $current_user; 
if ( is_user_logged_in() ) { 
    echo 'Username: ' . $current_user->user_login . "\n"; 
    echo 'User display name: ' . $current_user->display_name . "\n"; 
    } else { 

This works if I use the URL domain.com/intranet/page.php but not on intranet.domain.com/page.php How can I get it to work for subdomains? I've tried adding the following to wp-config.php but that hasn't done anything:

define('COOKIE_DOMAIN', '.domain.com'); // Used to authenticate subdomains
define('COOKIEPATH', '/'); 

Any ideas?

  • is this a multisite? Or two separate installs? Or one install that is not a multisite? If it does not work, how is it broken? Are you bootstrapping WordPress into standalone PHP files? It's highly unusual to directly visit a PHP file that didn't come from WordPress itself
    – Tom J Nowell
    Commented Feb 14, 2022 at 19:16
  • It's standalone PHP files outside of wordpress. Trying to integrate existing web apps using the Wordpress authantication rather than 2 sets of user data. I know it's slightly unusual, but this is the requirement I'm faced with.
    – TomC
    Commented Feb 14, 2022 at 19:28
  • you'll need to provide more information about where WordPress is located, if it's a multisite or a single site, etc, there's not enough information here to make a recommendation or write an answer, and you only answered the last question I asked and ignored the first 4 questions. If you do not know the answers please say so
    – Tom J Nowell
    Commented Feb 14, 2022 at 19:59
  • 1
    Sorry Tom - I thought it was clear from my response, but my mistake. The WP is a single site in the parent public_html dir (domain.com) and the web app is in a sub-domain (intranet.domain.com) which is just a pointer to a sub-directory (domain.com/intranet). So calling it in the sub-directory works, but when I call it using the subdomain URL it doesn't. When I say it doesn't work, I mean that the username is displayed as expected using the full URL but not when I use the subdomain URL.
    – TomC
    Commented Feb 14, 2022 at 22:12
  • 1
    And the expected cookie is there on the full URL but not on the subdomain URL.
    – TomC
    Commented Feb 14, 2022 at 22:12

1 Answer 1


Ensure that COOKIEHASH has the same value for both, e.g.:

define( 'COOKIEHASH', md5( 'https://yourdomain.com' ) );
define( 'COOKIE_DOMAIN', '.yourdomain.com' );

See https://wordpress.stackexchange.com/a/264490/736

  • 1
    Took me ages to get this working until I realised the code needs to be before require_once(ABSPATH . 'wp-settings.php');
    – TomC
    Commented Feb 15, 2022 at 22:00
  • This has been working fine for me and I've just migrated to a new VPS and getting this: Warning: Constant COOKIEHASH already defined in / Any suggestions why?
    – TomC
    Commented Jul 14, 2023 at 6:08
  • none, maybe best as a new question but I'd put the entire error message in when you ask it, and I'd also do a search for COOKIEHASH across the files to find the other define statement if it's not in that file
    – Tom J Nowell
    Commented Jul 14, 2023 at 9:16
  • Not sure why I wasn't seeing the errors before, but seems like I didn't need it in the sub-domain header so removed and now working.
    – TomC
    Commented Jul 16, 2023 at 7:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.