WordPress Custom Login with Basic Authentication

If you want to take complete control over the validating a user’s login credentials against a WordPress database (or an external database that uses WordPress’ password hashing, as was the case for me), the following code should provide a good starting point.

In this particular example we’re using HTTP Basic Authentication to present the ‘login form’, and enforce authentication on a given directory defined in an Apache .htaccess file. The private function _authenticate_wp() along with the require() are the only bits of the code below you need if you just want to validate a WordPress user’s username/password combination

# import the wp environment, aka load all this overhead just to chack a password
# define("BASE_PATH", "/path/to/top/of/your/wp/install"
require(BASE_PATH . '/wp-blog-header.php');

class TMRSAuthentication
{
    public function do_basic_authentication()
    {
        if (!isset($_SERVER['PHP_AUTH_USER'])) {
            header('WWW-Authenticate: Basic realm="Login with your WordPress Username and Password"');
            header('HTTP/1.0 401 Unauthorized');
            # this message is displayed if the user cancels login
            $this->show_failed_login();
            exit;
        } else {
            $username = $_SERVER['PHP_AUTH_USER'];
            $password = $_SERVER['PHP_AUTH_PW'];
            if( $this->_authenticate_wp($username, $password) ) {
                return true;
            } else {
                return false;
            }
        }
    }

    private function _authenticate_wp($username, $password)
    {
        global $wp_error;
        if ( empty($wp_error) ) {
            $wp_error = new WP_Error();
        }
        $user = wp_authenticate($username, $password);
        if(is_wp_error($user)) {
            return false;
        } else {
            return true;
        }
    }

    public function show_failed_login()
    {
        echo "Login failed";
    }

}

Here’s how you’d use the class above:

$auth = new TMRSAuthentication();
if( $auth->do_basic_authentication() ) {
    echo "login successful";
} else {
    $auth->show_failed_login();
}