CodeIgniter WordPress Bridge

A WordPress plugin that authenticates users from a CodeIgniter 3 database session. CodeIgniter remains responsible for login and session management; WordPress creates or reuses a linked subscriber account for the current request.

Supported versions

• CodeIgniter 3.1.13 with the database session driver and MySQL or MariaDB
• WordPress 6.8 or later, single-site installations only
• PHP 7.4 or later on the WordPress side, with mysqli
• Session serializers: php, php_binary, and php_serialize

CI 2, CI 4, WordPress multisite, and file, Redis, Memcached, PostgreSQL, custom, or encrypted session stores are not supported.

These are source-reviewed targets. This project has not been runtime-tested against every version combination.

How it works

1. WordPress checks its normal authentication methods first.
2. If the visitor is still anonymous, the plugin reads the CI session ID from its cookie.
3. It loads the matching session from the CI database and checks its age, format, and optional IP binding.
4. It accepts only an explicit authenticated and email-verified identity stored by the CI application.
5. It finds or creates the linked WordPress subscriber and uses that account for the current request.

The plugin does not create a WordPress login cookie. CI logout or session expiry therefore ends bridge access on the next request. Existing native WordPress logins remain independent and take precedence.

Setup

1. Configure CodeIgniter sessions

Use the stock CI 3 database session driver. The relevant settings normally look like this:

$config['sess_driver'] = 'database';
$config['sess_cookie_name'] = 'ci_session';
$config['sess_save_path'] = 'ci_sessions';
$config['sess_expiration'] = 7200;
$config['sess_match_ip'] = false;
$config['sess_regenerate_destroy'] = true;
$config['cookie_path'] = '/';
$config['cookie_secure'] = true;
$config['sess_samesite'] = 'Lax';

Create the standard ci_sessions table. The CI cookie must be available to the WordPress path or hostname. Both applications must use HTTPS; do not share the cookie with untrusted subdomains.

2. Store the bridge identity after CI login

After the user has passed your password or SSO checks, MFA, account-status checks, and email verification, store this session value:

$this->session->set_userdata('ciwp_identity', array(
    'authenticated' => true,
    'subject' => (string) $user['id'],
    'email' => $user['email'],
    'email_verified' => true,
));

subject must be a stable, never-reused user ID. Do not use an email address or display name. Remove the claim and destroy the session during logout or account revocation.

A fuller integration fragment is available in examples/codeigniter-login.example.php.

3. Install the WordPress plugin

Copy the repository to:

wp-content/plugins/codeigniter-wordpress-bridge/

Do not replace WordPress's wp-load.php. If the original version of this project was installed, restore the official wp-load.php supplied with your exact WordPress version first.

Create a MySQL user that has SELECT permission only on the CI session table. Do not reuse the CI application's main database credentials.

4. Configure WordPress

Add CIWP_BRIDGE to wp-config.php before WordPress loads wp-settings.php:

define('CIWP_BRIDGE', array(
    'enabled' => true,
    'issuer' => 'my-codeigniter-app',
    'cookie_name' => 'ci_session',
    'table' => 'ci_sessions',
    'serializer' => 'php',
    'max_age' => 7200,
    'match_ip' => false,
    'auto_create' => false,
    'database' => array(
        'host' => 'localhost',
        'port' => 3306,
        'socket' => null,
        'name' => 'codeigniter_database',
        'user' => 'ci_session_reader',
        'password' => 'replace-this',
    ),
));

The complete template is in examples/wp-config.example.php. Keep real credentials in wp-config.php, outside the plugin directory.

• issuer identifies the CI application. Keep it unchanged after users are created.
• serializer must match session.serialize_handler in the CI web runtime.
• max_age must match or be shorter than CI's effective session lifetime.
• match_ip must match CI's sess_match_ip setting.
• auto_create defaults to false. Set it to true when new CI users should receive WordPress subscriber accounts.

Activate CodeIgniter WordPress Bridge from the WordPress Plugins page.

New accounts are subscribers. The bridge never links an existing account by email alone and never authenticates administrators or editors. Profile and email synchronization are outside its scope.

REST API and page caching

Bridge-authenticated REST requests need a normal WordPress wp_rest nonce in X-WP-Nonce or _wpnonce. Requests without a nonce are treated as anonymous.

Configure page caches and CDNs to bypass cache reads and writes whenever the CI session cookie is present. The plugin sends no-cache hints, but it cannot control a cache that runs before WordPress loads plugins.

Troubleshooting

Authentication failures leave the visitor anonymous. The plugin emits a ciwp_bridge_error action with a short error code for private logging. Check:

• the CI cookie reaches WordPress and has no duplicate name with another path or domain;
• WordPress detects the request as HTTPS;
• the database user can read the CI session table;
• serializer, max_age, and match_ip match CI;
• ciwp_identity contains the exact values shown above and is not flashdata or tempdata;
• auto_create is enabled when the WordPress account does not exist;
• upstream caches bypass requests containing the CI cookie.

Never log session cookies, decoded session data, passwords, or raw database errors.