Automatic WordPress Admin Login in PHP

Today’s post is only going to be a short one in which I am going to show you how to install a neat little feature on your WordPress site. This, if used safely, can be very convenient. This is designed to be used on WordPress sites which offer a generic account for users to login to. For example, on many backend WordPress demos the author will create a ‘demo’ account for prospective customers to login as and play with his/her product. More often than not, the author will simply display a notice saying;

USERNAME: demo
PASSWORD: demo

This is a bit pedestrian. Surely we can make the demo look slightly more streamlined and professional? I will give you a quick snippet to automatically login to the WordPress admin with these credentials. This can either be dropped into your theme’s functions file, or can be put in its own plugin file and activated.

This could be useful if;

• Your site has a generic account for anonymous users to login to.
• You want a ‘one click’ login link.
• You want to maximize product demo conversion by providing a quick and efficient pathway to the demo, minimizing required steps.
• You want to direct visitors directly to the relevant location (eg. Settings page).

IMPORTANT: Never use this to login to accounts with real power; eg. Administrator/Editor accounts etc.
Use this snippet carefully.

Ok, so as I have done in my other tutorials, I’ll give you the complete, annotated code first so that those of you who aren’t fans of reading can get straight to experimenting with it. The following snippet has been styled in the form of a standalone plugin (my personal preference).

/*
Plugin Name: Auto Login
Plugin URI: http://hbt.io/
Version: 1.0.0
Author: Harri Bell-Thomas
Author URI: http://hbt.io/
*/

function autologin() {
	// PARAMETER TO CHECK FOR
	if ($_GET['autologin'] == 'demo') {
		
		// ACCOUNT USERNAME TO LOGIN TO
		$creds['user_login'] = 'demo';
		
		// ACCOUNT PASSWORD TO USE
		$creds['user_password'] = 'demo';
		
		$creds['remember'] = true;
		$autologin_user = wp_signon( $creds, false );
		
		if ( !is_wp_error($autologin_user) ) 
			header('Location: wp-admin'); // LOCATION TO REDIRECT TO
	}
}
// ADD CODE JUST BEFORE HEADERS AND COOKIES ARE SENT
add_action( 'after_setup_theme', 'autologin' );

USAGE

This is very simple to use. The account username and password are specified in the plugin file (code above), and to login you simply need to visit; http://example.com/wp-login.php?autologin=demo

You should immediately be redirected to wp-admin, logged into the account specified. If the credentials are wrong though, you should just see the login form as is normal.

CUSTOMIZE

This snippet is very easy to customise. There are essentially only 3 things you will need to edit, and all these changes are to made in the following code block (lines 11 to 17 of the complete code)

if ($_GET['login'] == 'dummy_account') {

        // ACCOUNT USERNAME TO LOGIN TO
        $creds['user_login'] = 'dummy';

        // ACCOUNT PASSWORD TO USE
        $creds['user_password'] = 'pa55word';

On the first line you will see the conditional checking for the URL parameter. The above code block will be checking for; wp-login.php?login=dummy_account

These values can be whatever you want, but be careful to avoid original WordPress parameters such as ‘loggedout’, ‘action’ and ‘redirect_to’. Line 4 is where you specify the username to login with; the customized code snippet will try to login to the ‘dummy’ account. As you can probably guess, line 7 is where you specify the password. The above password is ‘pa55word’. Fill these values out and you should be good to go!

EXTENSIONS

At the moment our snippet is only set up for auto-logging in to one account. What if we want different login links for different accounts? This is quite quick and easy to do and doesn’t require you to repeat the whole snippet again and again. Have a look below at my solution.

/*
Plugin Name: Auto Login
Plugin URI: http://hbt.io/
Description: Create convenient auto-login links to quickly login to generic accounts. Configure source code to make changes.
Version: 1.0.0
Author: Harri Bell-Thomas
Author URI: http://hbt.io/
*/

// Declare global var's
global $login_parameter, $accounts;

// THE PARAMETER TO CHECK FOR
// eg. http://exmaple.com/wp-login.php?param_name=account
$login_parameter = "autologin";

// ACCOUNT CODE BLOCK
$accounts[] = array(
				"user" => "demo",
				"pass" => "demo",
				"location" => "wp-admin",
			  );
// END ACCOUNT CODE BLOCK

// EDIT AND REPEAT CODE BLOCK FOR AS MANY ACCOUNTS AS NEEDED

// Another example iteration
$accounts[] = array(
				"user" => "tcwp",
				"pass" => "demo",
				"location" => "wp-admin/?tcwp-sent-me",
			  );


// SEE PREVIOUS EXAMPLE FOR DETAILS ABOUT THIS FUNCTION
function autologin() {
	global $login_parameter, $accounts;
	foreach ($accounts as $account) {
		if ($_GET[$login_parameter] == $account['user']) {
			$creds['user_login'] = $account['user'];
			$creds['user_password'] = $account['pass'];
			$creds['remember'] = true;
			$autologin_user = wp_signon( $creds, false );
			if ( !is_wp_error($autologin_user) ) 
				header('Location: ' . $account['location']); 
		}
	}
}
add_action( 'after_setup_theme', 'autologin' );

At its core this is essentially the same, but with a cheeky foreach loop plus accounts array thrown in as well. The anatomy of the autologin() function is identical, except for the fact its code is repeated (using the foreach loop) for each account. All relevant details are now stored in the global array. The above example is set up for 2 accounts, but our snippet can accommodate for as many as we need. To add additional accounts simply customise and add as many of the following code blocks as you need.

// ACCOUNT CODE BLOCK
$accounts[] = array(
				"user" => "anotheraccount",
				"pass" => "public_password",
				"location" => "http://YouCanPutURLsHereToo.com/",
			  );
// END ACCOUNT CODE BLOCK

You will also notice I have moved the parameter name to a global variable as well: this is not necessary, but I did so simply to remove all hard coded values from the autologin() function.

CONCLUSION

This snippet is only a simple function designed for lightweight usage, such as on a product demo site, but does have the potential to be used for much more complex login scenarios. The rest of the code should be pretty self-explanatory, but if you have any questions about what I’ve done, or why I have done it, just leave a comment below or tweet me. If you have any feedback/suggestions/ideas leave a comment in the comment section below!