I am developing custom login page and want to login through username and password. To authenticate user, i am using this function wp_authenticate_username_password()

$usr_user = wp_authenticate_username_password($user_obj, $username, $password)

But when I enter wrong password, its still giving user object in return. When I enter wrong username and password then only its giving error. On providing correct username and wrong password its returning user object. I think thats not how it meant to work. It should not return user object when passing wrong password Anyone who else have faced this or know about it.

Thanks in advance

1 Answer 1


Looking at the source code of wp_authenticate_username_password(), if you're passing a valid WP_User object in the $user_obj parameter, it will simply be returned. Only if $user_obj is not a valid WP_User will the $username and $password parameters be checked.

If you're trying to ensure a user's username and password are valid, I'd recommend using wp_authenticate() instead.

  • Thanks. It helped me. When I passed empty user id like this - wp_authenticate_username_password('', $usr_username, $usr_password); then its working fine. Commented Feb 22 at 17:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.