What is Authentication?
Authentication is the process through which something is confirmed as being authentic, in other words, true. In WordPress environments, authentication refers to the process through which WordPress ensures that the login credentials (a username and the corresponding password) supplied by a user are true, that is to say, that the exact combination exists in its database.
Why is authentication important on WordPress websites?
Authentication is a very important process on WordPress and any other system. It allows us to identify users who have an account on our website and provide them with access to the system. This is not to be confused with authorization, which is the process through which users are granted access to the resources they have rights to. Because they’re so closely related, authentication and authorization are often confused; however, a distinction needs to be made between them to ensure the correct process is being addressed.
How WordPress authentication works
Several things happen during the authentication process. Once users fill in their username and passwords and hit send, the browser sends that information to WordPress. If the WordPress website has an SSL/TLS certificate, the credentials are encrypted before they’re sent to WordPress; otherwise, they’re sent in plain text.
Note: if a WordPress website is not running on HTTPS, an attacker can easily steal the WordPress user credentials.
Once WordPress receives the credentials, it hashes the information and compares it to what is stored in the database. If there is a match, authentication is successful. If there isn’t a match, authentication fails.
WordPress also uses hashed-data cookies to authenticate users. As such, the web browser used to log in to WordPress must have cookies enabled. Since the data is hashed, there is no need to worry about anyone stealing your login information.
WordPress also provides an authenticate filter hook, allowing developers and administrators to automate additional tasks triggered by the login process. These filter hooks can be used in different ways, depending on what the developer wants to accomplish.
How to secure the WordPress authentication process
The WordPress authentication process can be made more secure through a combination of configurations.
Install an SSL/TLS certificate
An SSL/TLS certificate encrypts communication between website visitors and WordPress, ensuring that information can be securely sent back and forth. This not only helps put your website’s visitors and users’ minds at ease but can also help you in other ways, including SEO and compliance.
For more information on this subject and how you can configure your WordPress website to use HTTPS, refer to WordPress HTTPS, SSL & TLS guide for website administrators.
Enforce strong password security and policies
Strong passwords are more difficult to guess or hack, making them a no-brainer. You can easily improve WordPress password security by enforcing a strong password policy through plugins such as WPassword, which offers a high degree of control over how you design your password policy.
Install a 2FA plugin
Two-factor authentication (2FA) plugins, such as WP 2FA, implement an additional authentication layer by using an OTP (One Time Password) over and above the username and password combination. OTPs are delivered through a mobile app, thus ensuring that nobody would be able to pass the authentication process without access to the phone paired with that username, even if passwords get compromised.
Install a CAPTCHA plugin
CAPTCHA plugins such as CAPTCHA 4WP are great at stopping automated attacks. Scripts behind such automated attacks will try to guess a valid username and password combination; however, they will be stopped in their tracks without the ability to pass the CAPTCHA test.
