Authentication & session security

When to use this skill

Use this skill whenever code touches the login or session lifecycle:

• Signing users in with wp_signon() or a custom login form / endpoint.
• Any wp_ajax_nopriv_ or REST route that accepts a username and password.
• Reading or setting auth cookies, or handling "remember me".
• Creating, listing, or destroying sessions (WP_Session_Tokens).
• Handling wp_login_failed, wp_login, password changes, or role changes.
• Building a front-end login page that redirects via redirect_to.
• Gating behavior on is_user_logged_in().

WordPress ships complete, battle-tested authentication primitives: wp_signon() for credential checks, signed hashed auth cookies, and per-user session stores. Vulnerabilities come from agents rolling custom auth beside them — unthrottled custom login endpoints, hand-rolled cookies, sessions kept alive after a privilege change, and user enumeration through login error messages.