Hot answers tagged

2

wp_signon() actually already calls wp_set_auth_cookie() which is the function that sets the "remember me" cookie, hence you don't need to manually call that function. And that (wp_set_auth_cookie($user->ID)) is actually the problem in your code, because it's overwriting the "remember me" cookie that was already set.


2

Because there is no wp-admin.php file in WordPress: You shouldn't be able to login via wp-admin.php, it should not exist! Be extremely suspicious of this file, you may have been hacked, and have likely leaked your details to an attacker.


1

Looks like it would work! I ended up using something like this: if( !($some_variable === 'uk' || $another_variable === 'in')){ //this occurs when neither of the above are true } courtesy of a comment by @Habchi on this thread: https://stackoverflow.com/questions/19949923/simpler-way-to-check-if-variable-is-not-equal-to-multiple-string-values I'll post ...


1

|| means OR. Your code will never allow $current_user to proceed because one of the OR conditions will fail. Try using AND && instead: if ( ($current_user->user_login != 'john') && ($current_user->user_login != 'sheila' ) ) {


1

wp-login.php should not require additional effort from you to secure. However, I don't think that's what you client is asking for. My question therefore is does Wordpress require further development to stop SQL injections etc on login forms? And do I need to apply input sanitation to the login fields? To wp-login.php, no, you don't. Not for security ...


Only top voted, non community-wiki answers of a minimum length are eligible