I am going to enhance my WordPress authentication page. My idea is that simply adding an extra field into the login page. The extra field will require user to enter personal identification code (4 to 8 digit).

I have changed the login page layout in wp-login.php and added extra column for storing personal identification code in MySQL database.

However, I don't know which part of coding is used to verify the password as I want to refer to the existing coding.

How can I effecively do that?

3 Answers 3


First of all, I would advise against editing the core files as it will be overwritten when you next update WordPress.

Also, you should update WordPress, because it will often include security updates. (It's recently been reported that there has been a spate of attacks on sites using outdated WordPress versions)

In order to achieve what you actually want to do, I recommend you use hooks as the best way to edit WordPress.

As such, to create an extra field on your login page, you may use the login_form action hook:

function my_added_login_field(){
    //Output your HTML
        <label for="my_extra_field">My extra field<br>
        <input type="text" tabindex="20" size="20" value="" class="input" id="my_extra_field" name="my_extra_field_name"></label>

Next we need to verify that what they entered into the field matched what you have stored. In the following code, I've assumed you've stored the identification code as a user meta value with meta key my_ident_code. You should do this rather than create your own column!. See the Codex pages for

To verify a users you can use the authenticate filter. This passes the entered username and password. If the identification code is correct, return null to allow WordPress to verify the password and username. If it is not correct, remove the WordPress' authentication and return an error. This forces the user back to the log-in page, where they'll see the error displayed.

add_filter( 'authenticate', 'my_custom_authenticate', 10, 3 );
function my_custom_authenticate( $user, $username, $password ){
    //Get POSTED value
    $my_value = $_POST['my_extra_field_name'];

    //Get user object
    $user = get_user_by('login', $username );

    //Get stored value
        $stored_value = get_user_meta($user->ID, 'my_ident_code', true);

    if(!$user || empty($my_value) || $my_value !=$stored_value){
        //User note found, or no value entered or doesn't match stored value - don't proceed.
            remove_action('authenticate', 'wp_authenticate_username_password', 20);
            remove_action('authenticate', 'wp_authenticate_email_password', 20); 

        //Create an error to return to user
            return new WP_Error( 'denied', __("<strong>ERROR</strong>: You're unique identifier was invalid.") );

    //Make sure you return null 
    return null;
  • It's a shame this wasn't marked as correct, as it's a perfectly explained and coded answer that works 100%.
    – Nathan
    Dec 4, 2020 at 15:08

This answer for reference purpose only.

You should not edit core files WordPress files or else you will lose your modifications after an update.

Below is how WordPress handles it's login password verification process as seen on line 250 of the /wp-includes/class-phpass.php file:

function CheckPassword($password, $stored_hash)
    $hash = $this->crypt_private($password, $stored_hash);
    if ($hash[0] == '*')
        $hash = crypt($password, $stored_hash);

    return $hash == $stored_hash;

If editing all that code seems a little daunting there is a good plugin for this:

Cimy Extra Fields

Or you could consider using Theme My login which can do this, but it takes some coding. It also adds quite a bit of extra functionality. You can happily use these two plugins together.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.