wp_authenticate_email_password( WP_User|WP_Error|null $user, string $email, string $password ): WP_User|WP_Error

Parameters

$userWP_User|WP_Error|null

WP_User or WP_Error object if a previous callback failed authentication.

$emailstring

Email address for authentication.

$passwordstring

Password for authentication.

Return

WP_User|WP_Error

WP_User on success, WP_Error on failure.

Cost profile

Measured from the compiled opcodes, not from a stopwatch. Every number here is identical on any machine that runs the same PHP version, and every function in core is ranked by these figures.

Cost class

Heavy

Reaches the database via get_user_by().

Scaling

Constant

No loop in the body: the same number of instructions runs whatever you pass in.

Instructions

6–67

Executed per call on PHP 8.4, depending on the branch taken. The body compiles to 121.

Plugin surface

1 hook

Third-party callbacks on 'wp_authenticate_user' run inside this call, and their cost is not bounded by anything here.

Called by

0

Nothing in core calls this; the cost is only what you spend yourself.

What it touches

• querycontent queryget_user_by()called directly
• hookthird-party callbacksapply_filters()called directly

Further down the call graph this can also reach option, cache, serialize and transient — those are the worst case, several calls deep and usually down an error path, not what a normal call pays.

What one call costs · 10 distinct outcomes

One number would be a lie: the work depends on which branch runs. These are every distinct cost wp_authenticate_email_password() can have, taken from its control-flow graph on PHP 8.4.

Across PHP versions

Oldest PHP that compiles this body: 7.4. An instruction is not a fixed amount of time, so a version with the same count is not necessarily the same speed; what the count rules out is a difference in the work itself.

Hooks fired · 1

One hook fires while wp_authenticate_email_password() runs, in this order:

1. 1
   apply_filters( wp_authenticate_user )filterline 285 (+43 into the body)

   Filters whether the given user can be authenticated with the provided password.

Uses · 11

• is_wp_error()Checks whether the given variable is a WordPress Error.
• __()Retrieves the translation of $text.
• is_email()Verifies that an email is valid.
• get_user_by()Retrieves user info by a given field.
• apply_filters()Calls the callback functions that have been added to a filter hook.
• wp_check_password()Checks a plaintext password against a hashed password.
• esc_html()Escaping for HTML blocks.
• wp_lostpassword_url()Returns the URL that allows the user to reset the lost password.
• wp_password_needs_rehash()Checks whether a password hash needs to be rehashed.
• wp_set_password()Updates the user's password with a new hashed one.
• WP_Error::__construct()Initializes the error.

Source

View on Trac ↗View on GitHub ↗

242function wp_authenticate_email_password(243	$user,244	$email,245	#[\SensitiveParameter]246	$password247) {248	if ( $user instanceof WP_User ) {249		return $user;250	}251 252	if ( empty( $email ) || empty( $password ) ) {253		if ( is_wp_error( $user ) ) {254			return $user;255		}256 257		$error = new WP_Error();258 259		if ( empty( $email ) ) {260			// Uses 'empty_username' for back-compat with wp_signon().261			$error->add( 'empty_username', __( '<strong>Error:</strong> The email field is empty.' ) );262		}263 264		if ( empty( $password ) ) {265			$error->add( 'empty_password', __( '<strong>Error:</strong> The password field is empty.' ) );266		}267 268		return $error;269	}270 271	if ( ! is_email( $email ) ) {272		return $user;273	}274 275	$user = get_user_by( 'email', $email );276 277	if ( ! $user ) {278		return new WP_Error(279			'invalid_email',280			__( 'Unknown email address. Check again or try your username.' )281		);282	}283 284	/** This filter is documented in wp-includes/user.php */285	$user = apply_filters( 'wp_authenticate_user', $user, $password );286 287	if ( is_wp_error( $user ) ) {288		return $user;289	}290 291	$valid = wp_check_password( $password, $user->user_pass, $user->ID );292 293	if ( ! $valid ) {294		return new WP_Error(295			'incorrect_password',296			sprintf(297				/* translators: %s: Email address. */298				__( '<strong>Error:</strong> The password you entered for the email address %s is incorrect.' ),299				'<strong>' . esc_html( $email ) . '</strong>'300			) .301			' <a href="' . wp_lostpassword_url() . '">' .302			__( 'Lost your password?' ) .303			'</a>'304		);305	}306 307	if ( wp_password_needs_rehash( $user->user_pass, $user->ID ) ) {308		wp_set_password( $password, $user->ID );309	}310 311	return $user;312}

History

Introduced in 4.5.0. Unchanged from 6.7.7 through 7.1.0.

1. 6.7.7
2. 6.8.8
3. 6.9.7
4. 7.0.4
5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data

Generated from the wordpress-develop 7.0.4 tag, from src/wp-includes/user.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.

Corrections

Something wrong on this page? Report it and it gets fixed in the next regeneration.