Curated resource guide
WordPress Authentication and Access Control
Design WordPress authentication and authorization around verified identity and least privilege. This collection covers roles, capabilities, sessions, cookies, REST nonces, Application Passwords, 2FA, SSO concepts, multisite and WooCommerce access, service accounts, audit logging, and the prevention of authorization flaws in custom code.
Scope
What this guide covers
- WordPress authentication flow
- users, roles and capabilities
- custom capabilities
- least privilege
- login security
- 2FA
- Application Passwords
- cookie authentication
- REST nonces
- password policies
- SSO
- OAuth/OIDC/SAML concepts
- magic links where appropriate
- session management
- forcing logout
- password resets
- multisite access
- WooCommerce customer accounts
- admin access restrictions
- audit logging
- service accounts
- API authentication
- and avoiding authorization bugs in custom development
Selected references
Curated resources
Links open the original publisher so you can use the complete, current material in context.
- 01Recommended starting point
Roles and Capabilities
Design authorization around capabilities and current-user checks rather than role names or hidden interface controls.
developer.wordpress.org - 02
WordPress Application Passwords
Issue revocable per-application credentials for authenticated API access without sharing account passwords.
developer.wordpress.org - 03
REST API Authentication
Choose supported authentication for same-site, remote, and application-level REST requests.
developer.wordpress.org - 04
WordPress Nonces
Use nonces for intent and CSRF checks while keeping authentication and capability authorization separate.
developer.wordpress.org - 05
wp_destroy_all_sessions() Reference
Invalidate every active session token for the current user during account or incident response.
developer.wordpress.org - 06
WordPress Two-Factor Plugin
Add and test maintained two-factor providers built by WordPress contributors.
wordpress.org - 07
OWASP Authentication Cheat Sheet
Review modern authentication, recovery, reauthentication, logging, and defense recommendations.
cheatsheetseries.owasp.org - 08
map_meta_cap() Reference
Understand how object-aware meta capabilities become primitive checks for the current request context.
developer.wordpress.org - 09
wp_signon() Reference
Work with the native credential sign-in path while preserving secure cookie and authentication behavior.
developer.wordpress.org - 10
current_user_can() Reference
Authorize each protected action against capabilities rather than trusting UI visibility or ownership assumptions.
developer.wordpress.org - 11
OWASP Authorization Cheat Sheet
Apply deny-by-default, least privilege, object-level checks, and consistent authorization design.
cheatsheetseries.owasp.org - 12
OWASP Session Management
Review cookie, lifecycle, fixation, expiration, and logout controls around authenticated WordPress sessions.
cheatsheetseries.owasp.org