authentication-session-security
From the author
Use when code logs users in or out, sets or clears auth cookies, manages session tokens, throttles failed logins, or builds a custom login form in WordPress. Enforces wp_signon() and core session primitives over hand-rolled credential checks, adds brute-force throttling via the wp_authenticate_user filter keyed on username + IP, destroys sessions after password or role changes, makes login error messages uniform to stop user enumeration, and validates redirect_to with wp_safe_redirect() to close open redirects.
Install
npx skills add wpultimatesecurity/WordPress-Security-Skills --skill authentication-session-security -a claude-code
Installs to .claude/skills/authentication-session-security/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
- Ships scripts we have not reviewedLow
Why 76
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- cron-background-job-securitywpultimatesecurity/WordPress-Security-SkillsUse when scheduling WordPress cron events with wp_schedule_event / wp_schedule_single_event or writing the callback that runs on a cron hook. Treats cron callbacks as running without a logged-in user, re-checks authorization against stored context rather than current_user_can, keeps secrets out of cron URLs, and validates any stored input the job consumes. Prevents unauthenticated privileged actions via the cron surface.Security★ 53
- secure-plugin-developmentwpultimatesecurity/WordPress-Security-SkillsUse when starting a new WordPress plugin or theme, scaffolding a plugin file, wiring hooks, or adding any feature that handles requests, options, or output. Establishes the secure-by-default baseline — ABSPATH guard, the capability + nonce + sanitize + escape flow, prepared queries, and safe defaults — and routes to the focused security skills for each concern. Apply proactively at the start of any WordPress build.Security★ 53
- wordpress-plugin-coresecondsky/claude-skillsWordPress plugin development with hooks, security, REST API, custom post types. Use for plugin creation, $wpdb queries, Settings API, or encountering SQL injection, XSS, CSRF, nonce errors.Security★ 236
- verify-login-logoutreticlehq/reticleProve sign-in lands the user where they should be, sign-out really ends the session so a protected page sends them back to sign in, and an expired session asks to sign in again instead of breaking. Use when auth, a login form, a logout button, route guards or token refresh were added or changed, or when a user reports being logged out, or not logged out, unexpectedly.Other★ 1.3K
- secrets-credentials-managementwpultimatesecurity/WordPress-Security-SkillsUse when handling passwords, API keys, tokens, or third-party credentials in a WordPress plugin or theme. Hashes passwords with wp_hash_password / wp_check_password, generates tokens with wp_generate_password, keeps secrets out of code and the database in plaintext, and uses Application Passwords for API auth. Prevents credential leakage and insecure storage.Data★ 53
- wp-cli-securitywpultimatesecurity/WordPress-Security-SkillsUse when registering a WP-CLI command with WP_CLI::add_command or writing command logic. Validates and sanitizes positional and associative arguments, does not assume a logged-in user or capability context, avoids printing secrets, and confirms destructive operations. Prevents injection and unsafe automation through the CLI surface.Security★ 53
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in