Title: wp_authenticate_cookie
Published: April 25, 2014
Last modified: April 28, 2025

---

# wp_authenticate_cookie( WP_User|WP_Error|null $user, string $username, string $password ): 󠀁[WP_User](https://developer.wordpress.org/reference/classes/wp_user/)󠁿|󠀁[WP_Error](https://developer.wordpress.org/reference/classes/wp_error/)󠁿

## In this article

 * [Parameters](https://developer.wordpress.org/reference/functions/wp_authenticate_cookie/?output_format=md#parameters)
 * [Return](https://developer.wordpress.org/reference/functions/wp_authenticate_cookie/?output_format=md#return)
 * [Source](https://developer.wordpress.org/reference/functions/wp_authenticate_cookie/?output_format=md#source)
 * [Related](https://developer.wordpress.org/reference/functions/wp_authenticate_cookie/?output_format=md#related)
 * [Changelog](https://developer.wordpress.org/reference/functions/wp_authenticate_cookie/?output_format=md#changelog)

[ Back to top](https://developer.wordpress.org/reference/functions/wp_authenticate_cookie/?output_format=md#wp--skip-link--target)

Authenticates the user using the WordPress auth cookie.

## 󠀁[Parameters](https://developer.wordpress.org/reference/functions/wp_authenticate_cookie/?output_format=md#parameters)󠁿

 `$user`[WP_User](https://developer.wordpress.org/reference/classes/wp_user/)|[WP_Error](https://developer.wordpress.org/reference/classes/wp_error/)
|nullrequired

[WP_User](https://developer.wordpress.org/reference/classes/wp_user/) or [WP_Error](https://developer.wordpress.org/reference/classes/wp_error/)
object from a previous callback. Default null.

`$username`stringrequired

Username. If not empty, cancels the cookie authentication.

`$password`stringrequired

Password. If not empty, cancels the cookie authentication.

## 󠀁[Return](https://developer.wordpress.org/reference/functions/wp_authenticate_cookie/?output_format=md#return)󠁿

 [WP_User](https://developer.wordpress.org/reference/classes/wp_user/)|[WP_Error](https://developer.wordpress.org/reference/classes/wp_error/)
[WP_User](https://developer.wordpress.org/reference/classes/wp_user/) on success,
[WP_Error](https://developer.wordpress.org/reference/classes/wp_error/) on failure.

## 󠀁[Source](https://developer.wordpress.org/reference/functions/wp_authenticate_cookie/?output_format=md#source)󠁿

    ```php
    function wp_authenticate_cookie(
    	$user,
    	$username,
    	#[\SensitiveParameter]
    	$password
    ) {
    	global $auth_secure_cookie;

    	if ( $user instanceof WP_User ) {
    		return $user;
    	}

    	if ( empty( $username ) && empty( $password ) ) {
    		$user_id = wp_validate_auth_cookie();
    		if ( $user_id ) {
    			return new WP_User( $user_id );
    		}

    		if ( $auth_secure_cookie ) {
    			$auth_cookie = SECURE_AUTH_COOKIE;
    		} else {
    			$auth_cookie = AUTH_COOKIE;
    		}

    		if ( ! empty( $_COOKIE[ $auth_cookie ] ) ) {
    			return new WP_Error( 'expired_session', __( 'Please log in again.' ) );
    		}

    		// If the cookie is not set, be silent.
    	}

    	return $user;
    }
    ```

[View all references](https://developer.wordpress.org/reference/files/wp-includes/user.php/)
[View on Trac](https://core.trac.wordpress.org/browser/tags/6.9.4/src/wp-includes/user.php#L326)
[View on GitHub](https://github.com/WordPress/wordpress-develop/blob/6.9.4/src/wp-includes/user.php#L326-L358)

## 󠀁[Related](https://developer.wordpress.org/reference/functions/wp_authenticate_cookie/?output_format=md#related)󠁿

| Uses | Description | 
| [WP_User::__construct()](https://developer.wordpress.org/reference/classes/wp_user/__construct/)`wp-includes/class-wp-user.php` |

Constructor.

  | 
| [wp_validate_auth_cookie()](https://developer.wordpress.org/reference/functions/wp_validate_auth_cookie/)`wp-includes/pluggable.php` |

Validates authentication cookie.

  | 
| [__()](https://developer.wordpress.org/reference/functions/__/)`wp-includes/l10n.php` |

Retrieves the translation of $text.

  | 
| [WP_Error::__construct()](https://developer.wordpress.org/reference/classes/wp_error/__construct/)`wp-includes/class-wp-error.php` |

Initializes the error.

  |

[Show 2 more](https://developer.wordpress.org/reference/functions/wp_authenticate_cookie/?output_format=md#)
[Show less](https://developer.wordpress.org/reference/functions/wp_authenticate_cookie/?output_format=md#)

## 󠀁[Changelog](https://developer.wordpress.org/reference/functions/wp_authenticate_cookie/?output_format=md#changelog)󠁿

| Version | Description | 
| [2.8.0](https://developer.wordpress.org/reference/since/2.8.0/) | Introduced. |

## User Contributed Notes

You must [log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fwp_authenticate_cookie%2F)
before being able to contribute a note or feedback.