KeenWP

Curated resource guide

WordPress Authentication and Access Control

Design WordPress authentication and authorization around verified identity and least privilege. This collection covers roles, capabilities, sessions, cookies, REST nonces, Application Passwords, 2FA, SSO concepts, multisite and WooCommerce access, service accounts, audit logging, and the prevention of authorization flaws in custom code.

Scope

What this guide covers

  • WordPress authentication flow
  • users, roles and capabilities
  • custom capabilities
  • least privilege
  • login security
  • 2FA
  • Application Passwords
  • cookie authentication
  • REST nonces
  • password policies
  • SSO
  • OAuth/OIDC/SAML concepts
  • magic links where appropriate
  • session management
  • forcing logout
  • password resets
  • multisite access
  • WooCommerce customer accounts
  • admin access restrictions
  • audit logging
  • service accounts
  • API authentication
  • and avoiding authorization bugs in custom development

Selected references

Curated resources

Links open the original publisher so you can use the complete, current material in context.

  1. 01
    5
    Recommended starting point

    Roles and Capabilities

    Design authorization around capabilities and current-user checks rather than role names or hidden interface controls.

    developer.wordpress.org
  2. 02
    5

    WordPress Application Passwords

    Issue revocable per-application credentials for authenticated API access without sharing account passwords.

    developer.wordpress.org
  3. 03
    5

    REST API Authentication

    Choose supported authentication for same-site, remote, and application-level REST requests.

    developer.wordpress.org
  4. 04
    5

    WordPress Nonces

    Use nonces for intent and CSRF checks while keeping authentication and capability authorization separate.

    developer.wordpress.org
  5. 05
    5

    wp_destroy_all_sessions() Reference

    Invalidate every active session token for the current user during account or incident response.

    developer.wordpress.org
  6. 06
    5

    WordPress Two-Factor Plugin

    Add and test maintained two-factor providers built by WordPress contributors.

    wordpress.org
  7. 07
    5

    OWASP Authentication Cheat Sheet

    Review modern authentication, recovery, reauthentication, logging, and defense recommendations.

    cheatsheetseries.owasp.org