You might have a WordPress site which generates a file or some information daily, and you want to grab it without logging in to your site manually. It can be done using cURL. So you don’t have to log in and view the page anymore. Just use this script on your local server and run it. It will get you the content.

The modern way first: Application Passwords + REST API

Since WordPress 5.6, you don’t need to script a login at all for most of these jobs. Create an Application Password from WP Admin → Users → Profile → Application Passwords, and call the REST API with it –

curl --user "your_username:abcd efgh ijkl mnop qrst uvwx" \
    "https://example.com/wp-json/wp/v2/posts?context=edit"

Application passwords are revocable, they work over basic auth, and your real admin password never leaves your machine. If the data you need is available through the REST API (posts, users, media, or a custom endpoint), this is the way to go.

But if what you need is an actual admin page’s HTML, or a file download that only exists behind the login form, the cURL method below still does the job.

Following is a function to log in to a WordPress site

function curl_get_wp_login( $login_user, $login_pass, $login_url, $visit_url, $http_agent, $cookie_file ){

	if( !function_exists( 'curl_init' ) || ! function_exists( 'curl_exec' )){
		echo "cURL is not available in your PHP server.";
		return;
	}

	// Preparing postdata for wordpress login.
	// http_build_query handles url encoding, so special characters in the password are safe.
	$data = http_build_query( array(
		'log'         => $login_user,
		'pwd'         => $login_pass,
		'wp-submit'   => 'Log In',
		'redirect_to' => $visit_url
	));

	// Intialize cURL
	$ch = curl_init();

	// Url to use
	curl_setopt( $ch, CURLOPT_URL, $login_url );

	// Set the cookies for the login in a cookie file.
	curl_setopt( $ch, CURLOPT_COOKIEJAR, $cookie_file );

	// Disable SSL verification only for local / self-signed setups.
	// Keep verification on (true) for live sites.
	curl_setopt( $ch, CURLOPT_SSL_VERIFYPEER, false );

	// User agent
	curl_setopt( $ch, CURLOPT_USERAGENT, $http_agent );

	// Maximum time cURL will wait for a response, in seconds
	curl_setopt( $ch, CURLOPT_TIMEOUT, 60 );

	curl_setopt( $ch, CURLOPT_FOLLOWLOCATION, 1 );

	// Return the response instead of echoing it
	curl_setopt( $ch, CURLOPT_RETURNTRANSFER, 1 );

	// Set Http referer.
	curl_setopt( $ch, CURLOPT_REFERER, $login_url );

	// Post fields to the login url
	curl_setopt( $ch, CURLOPT_POSTFIELDS, $data );
	curl_setopt( $ch, CURLOPT_POST, 1);

	// Save the response in a variable
	$content = curl_exec ($ch);

	/*
	** if you need to visit another url, you can do it here.
	** curl_setopt( $ch, CURLOPT_URL, 'a new url address or a file download url' );
	** $content = curl_exec ($ch);
	*/

	// Close the cURL.
	curl_close( $ch );

	// You can echo or return the page data here.
	echo $content;
}

Now, to use the function, some variables need to be assigned.

// Username for login
$login_user = "admin";


/*
** Password for this username
*/
$login_pass = "1234";


/*
** Login url address.
*/
$login_url = "http://localhost/wordpress/wp-login.php";


/*
** Which page you want to visit after login.
** WordPress redirects the user automatically to this page after login.
** If you do not assign a visit page,
** then the result for this login will return '1'.
** That means you have logged in successfully.
** Visit url is important to get the content.
*/
$visit_url = 'http://localhost/wordpress/';


/*
** Cookie file. Use a path your script can write to.
*/
$cookie_file = __DIR__ . "/cookie.txt";


/*
** Set HTTP user agent.
*/
$http_agent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0";

// Test the call
curl_get_wp_login( $login_user, $login_pass, $login_url, $visit_url, $http_agent, $cookie_file );

That’s how easy it is.

Remember:
* A cURL request does not download any assets (images, css) from the html source code, so it loads faster than a normal visit.
* This method posts your real password to wp-login.php, so never leave real credentials hardcoded in a script that others can read. If you can get the same data over the REST API with an application password, prefer that.
* If your site has a security plugin with a login captcha, 2FA or a renamed login url, this form login will not work – another reason to use the REST API route.