Stores WordPress user accounts. Core authentication and profile data.

Schema

Indexes

Foreign Key Relationships

Referenced by:

• wp_posts.post_author → wp_users.ID
• wp_comments.user_id → wp_users.ID
• wp_usermeta.user_id → wp_users.ID
• wp_links.link_owner → wp_users.ID

Password Hashing

WordPress uses phpass-based hashing:

• Passwords start with $P$ (portable hash)
• Modern WP also supports bcrypt ($2y$)
• Never store or compare plaintext passwords

// Check password
wp_check_password( $plaintext, $hash, $user_id );

// Hash password
wp_hash_password( $plaintext );

Common Queries

Get user by ID

SELECT * FROM wp_users WHERE ID = 1;

Get user by login

SELECT * FROM wp_users WHERE user_login = 'admin';

Get user by email

SELECT * FROM wp_users WHERE user_email = '[email protected]';

Get all users with roles

SELECT u.ID, u.user_login, u.display_name, um.meta_value as capabilities
FROM wp_users u
JOIN wp_usermeta um ON u.ID = um.user_id
WHERE um.meta_key = 'wp_capabilities';

Get users registered in date range

SELECT * FROM wp_users 
WHERE user_registered BETWEEN '2024-01-01' AND '2024-12-31'
ORDER BY user_registered DESC;

Count users by registration month

SELECT DATE_FORMAT(user_registered, '%Y-%m') as month, COUNT(*) as count
FROM wp_users
GROUP BY month
ORDER BY month DESC;

Get user with post count

SELECT u.*, COUNT(p.ID) as post_count
FROM wp_users u
LEFT JOIN wp_posts p ON u.ID = p.post_author 
  AND p.post_type = 'post' 
  AND p.post_status = 'publish'
GROUP BY u.ID
ORDER BY post_count DESC;

WordPress API Functions

• get_user_by( $field, $value ) – Get user by ID, slug, email, or login
• get_userdata( $user_id ) – Get user data object
• wp_get_current_user() – Current logged-in user
• wp_create_user() – Create new user
• wp_update_user() – Update user
• wp_delete_user() – Delete user
• username_exists() – Check if username taken
• email_exists() – Check if email registered

Security Notes

• user_login cannot be changed after creation
• user_email must be unique
• user_activation_key is time-limited and single-use
• user_status is deprecated—spam status stored in usermeta