wppaste
WordPress

wp_signon( array $credentials = array(), string|bool $secure_cookie = '' ): WP_User|WP_Error

Since
2.5.0
Source
wp-includes/user.php:41
Authenticates and logs a user in with 'remember' capability.

Description

The credentials is an array that has 'user_login', 'user_password', and 'remember' indices. If the credentials is not given, then the log in form will be assumed and used if set.

The various authentication cookies will be set by this function and will be set for a longer period depending on if the 'remember' credential is set to true.

Note: wp_signon() doesn't handle setting the current user. This means that if the function is called before the 'init' hook is fired, is_user_logged_in() will evaluate as false until that point. If is_user_logged_in() is needed in conjunction with wp_signon(), wp_set_current_user() should be called explicitly.

Compatibility

WordPress
since 2.5.0
PHP
7.4–8.6-dev
  • 6.7.7
  • 6.8.8
  • 6.9.7
  • 7.0.4
  • 7.1.0

Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.

Parameters

$credentialsarrayoptional
User info in order to sign on.Default: array()

  • $user_loginstring

    Username.

  • $user_passwordstring

    User password.

  • $rememberbooldefault: false

    Whether to 'remember' the user. Increases the time that the cookie will be kept.
$secure_cookiestring|booloptional
Whether to use secure cookie.Default: ''

Return value

WP_User|WP_Error
WP_User on success, WP_Error on failure.

Performance profile

How much work a call to wp_signon() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.

Cost class
Moderate

Reads stored settings via get_option(), cached per request but not free on a cold cache.

Scaling
Constant

No loop in the body: the same number of instructions runs whatever you pass in.

Instructions
47–114

Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 117.

Plugin surface
3 hooks

Third-party callbacks on 'wp_authenticate', 'secure_signon_cookie', 'wp_login' run inside this call, and their cost is not bounded by anything here.

Called by
0

Nothing in core calls this; the cost is only what you spend yourself.

What it touches

  • hookthird-party callbacksdo_action_ref_array()called directly
  • optionoption read or writeget_option()one call below wp_signon()

Further down the call graph this can also reach cache, serialize, query and transient. Those are the worst case, several calls deep and usually down an error path, not what a normal call pays.

What one call costs · 12 distinct outcomes

One number would be a lie: the work depends on which branch runs. These are every distinct cost wp_signon() can have, taken from its control-flow graph on PHP 8.5.

WhenInstructionsCalls it makes
$secure_cookie !== "" && is_wp_error()47–74apply_filters(), add_filter(), wp_authenticate(), is_wp_error()
$secure_cookie === "" && is_wp_error()50–77is_ssl(), apply_filters(), add_filter(), wp_authenticate(), is_wp_error()
$secure_cookie !== "" && !is_wp_error() && empty($user)65–92apply_filters(), add_filter(), wp_authenticate(), is_wp_error(), wp_set_auth_cookie(), do_action()
$secure_cookie === "" && !is_wp_error() && empty($user)68–95is_ssl(), apply_filters(), add_filter(), wp_authenticate(), is_wp_error(), wp_set_auth_cookie(), do_action()
empty($credentials) && !empty($value) && $secure_cookie !== "" && is_wp_error()69–82wp_unslash(), apply_filters(), add_filter(), wp_authenticate(), is_wp_error()
empty($credentials) && !empty($value) && $secure_cookie === "" && is_wp_error()72–85wp_unslash(), is_ssl(), apply_filters(), add_filter(), wp_authenticate(), is_wp_error()
$secure_cookie !== "" && !is_wp_error() && !empty($user)76–103apply_filters(), add_filter(), wp_authenticate(), is_wp_error(), wp_set_auth_cookie(), ID(), do_action()
$secure_cookie === "" && !is_wp_error() && !empty($user)79–106is_ssl(), apply_filters(), add_filter(), wp_authenticate(), is_wp_error(), wp_set_auth_cookie(), ID(), do_action()
empty($credentials) && !empty($value) && $secure_cookie !== "" && !is_wp_error() && empty($user)87–100wp_unslash(), apply_filters(), add_filter(), wp_authenticate(), is_wp_error(), wp_set_auth_cookie(), do_action()
empty($credentials) && !empty($value) && $secure_cookie === "" && !is_wp_error() && empty($user)90–103wp_unslash(), is_ssl(), apply_filters(), add_filter(), wp_authenticate(), is_wp_error(), wp_set_auth_cookie(), do_action()
empty($credentials) && !empty($value) && $secure_cookie !== "" && !is_wp_error() && !empty($user)98–111wp_unslash(), apply_filters(), add_filter(), wp_authenticate(), is_wp_error(), wp_set_auth_cookie(), ID(), do_action()
empty($credentials) && !empty($value) && $secure_cookie === "" && !is_wp_error() && !empty($user)101–114wp_unslash(), is_ssl(), apply_filters(), add_filter(), wp_authenticate(), is_wp_error(), wp_set_auth_cookie(), ID(), do_action()

Across PHP versions

Compiles the same on PHP 7.4, 8.1, 8.2, 8.3, 8.4, 8.5 and 8.6-dev: 117 instructions, 47–114 executed per call, 10 branches. The work does not change between versions.

An instruction is not a fixed amount of time, so a matching count is not necessarily the same speed; what it rules out is a difference in the work itself.

Hooks and filters fired · 3

3 hooks fire while wp_signon() runs, in this order:

  1. do_action( wp_authenticate )actionline 81 (+40 into the body)

    Fires before the user is authenticated.

  2. apply_filters( secure_signon_cookie )filterline 102 (+61 into the body)

    Filters whether to use a secure sign-on cookie.

  3. do_action( wp_login )actionline 138 (+97 into the body)

    Fires after the user has successfully logged in.

Uses · 9

  • wp_unslash()Removes slashes from a string or recursively removes slashes from strings within an array.
  • do_action_ref_array()Calls the callback functions that have been added to an action hook, specifying arguments in an array.
  • is_ssl()Determines if SSL is used.
  • apply_filters()Calls the callback functions that have been added to a filter hook.
  • add_filter()Adds a callback function to a filter hook.
  • wp_authenticate()Authenticates a user, confirming the login credentials are valid.
  • is_wp_error()Checks whether the given variable is a WordPress Error.
  • wp_set_auth_cookie()Sets the authentication cookies for a given user ID.
  • do_action()Calls the callback functions that have been added to an action hook.

Source code

View on Trac View on GitHub 

function wp_signon( $credentials = array(), $secure_cookie = '' ) {	global $auth_secure_cookie, $wpdb; 	if ( empty( $credentials ) ) {		$credentials = array(			'user_login'    => '',			'user_password' => '',			'remember'      => false,		); 		if ( ! empty( $_POST['log'] ) && is_string( $_POST['log'] ) ) {			$credentials['user_login'] = wp_unslash( $_POST['log'] );		}		if ( ! empty( $_POST['pwd'] ) && is_string( $_POST['pwd'] ) ) {			$credentials['user_password'] = $_POST['pwd'];		}		if ( ! empty( $_POST['rememberme'] ) ) {			$credentials['remember'] = $_POST['rememberme'];		}	} 	if ( ! empty( $credentials['remember'] ) ) {		$credentials['remember'] = true;	} else {		$credentials['remember'] = false;	} 	/**	 * Fires before the user is authenticated.	 *	 * The variables passed to the callbacks are passed by reference,	 * and can be modified by callback functions.	 *	 * @since 1.5.1	 *	 * @todo Decide whether to deprecate the wp_authenticate action.	 *	 * @param string $user_login    Username (passed by reference).	 * @param string $user_password User password (passed by reference).	 */	do_action_ref_array( 'wp_authenticate', array( &$credentials['user_login'], &$credentials['user_password'] ) ); 	if ( '' === $secure_cookie ) {		$secure_cookie = is_ssl();	} 	/**	 * Filters whether to use a secure sign-on cookie.	 *	 * @since 3.1.0	 *	 * @param bool  $secure_cookie Whether to use a secure sign-on cookie.	 * @param array $credentials {	 *     Array of entered sign-on data.	 *	 *     @type string $user_login    Username.	 *     @type string $user_password Password entered.	 *     @type bool   $remember      Whether to 'remember' the user. Increases the time	 *                                 that the cookie will be kept. Default false.	 * }	 */	$secure_cookie = apply_filters( 'secure_signon_cookie', $secure_cookie, $credentials ); 	// XXX ugly hack to pass this to wp_authenticate_cookie().	$auth_secure_cookie = $secure_cookie; 	add_filter( 'authenticate', 'wp_authenticate_cookie', 30, 3 ); 	$user = wp_authenticate( $credentials['user_login'], $credentials['user_password'] ); 	if ( is_wp_error( $user ) ) {		return $user;	} 	wp_set_auth_cookie( $user->ID, $credentials['remember'], $secure_cookie ); 	// Clear `user_activation_key` after a successful login.	if ( ! empty( $user->user_activation_key ) ) {		$wpdb->update(			$wpdb->users,

Changelog

Introduced in 2.5.0. Unchanged from 6.7.7 through 7.1.0.

  1. 6.7.7
  2. 6.8.8
  3. 6.9.7
  4. 7.0.4
  5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data
Generated from the wordpress-develop 7.1.0 tag, from src/wp-includes/user.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.
Corrections
Something wrong on this page? Report it and it gets fixed in the next regeneration.