wp_authenticate( string $username, string $password ): WP_User|WP_Error

680	function wp_authenticate(681		$username,682		#[\SensitiveParameter]683		$password684	) {685		$username = sanitize_user( $username );686		$password = trim( $password );687 688		/**689		 * Filters whether a set of user login credentials are valid.690		 *691		 * A WP_User object is returned if the credentials authenticate a user.692		 * WP_Error or null otherwise.693		 *694		 * @since 2.8.0695		 * @since 4.5.0 `$username` now accepts an email address.696		 *697		 * @param null|WP_User|WP_Error $user     WP_User if the user is authenticated.698		 *                                        WP_Error or null otherwise.699		 * @param string                $username Username or email address.700		 * @param string                $password User password.701		 */702		$user = apply_filters( 'authenticate', null, $username, $password );703 704		if ( null === $user || false === $user ) {705			/*706			 * TODO: What should the error message be? (Or would these even happen?)707			 * Only needed if all authentication handlers fail to return anything.708			 */709			$user = new WP_Error( 'authentication_failed', __( '<strong>Error:</strong> Invalid username, email address or incorrect password.' ) );710		}711 712		$ignore_codes = array( 'empty_username', 'empty_password' );713 714		if ( is_wp_error( $user ) && ! in_array( $user->get_error_code(), $ignore_codes, true ) ) {715			$error = $user;716 717			/**718			 * Fires after a user login has failed.719			 *720			 * @since 2.5.0721			 * @since 4.5.0 The value of `$username` can now be an email address.722			 * @since 5.4.0 The `$error` parameter was added.723			 *724			 * @param string   $username Username or email address.725			 * @param WP_Error $error    A WP_Error object with the authentication failure details.726			 */727			do_action( 'wp_login_failed', $username, $error );728		}729 730		return $user;731	}