# Simple Math Question on the Login Form

> Adds a small addition question to wp-login.php that bots fail, without third-party CAPTCHA services or cookies.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: security, login, spam
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/login-math-challenge/

## Code

```php
add_action( 'login_form', function () {
    $a     = wp_rand( 1, 9 );
    $b     = wp_rand( 1, 9 );
    $time  = time();
    $token = hash_hmac( 'sha256', ( $a + $b ) . '|' . $time, wp_salt( 'nonce' ) );
    ?>
    <p>
        <label for="wpide_math"><?php echo esc_html( sprintf( 'What is %d + %d?', $a, $b ) ); ?></label>
        <input type="number" name="wpide_math" id="wpide_math" class="input" inputmode="numeric" autocomplete="off" required>
        <input type="hidden" name="wpide_math_time" value="<?php echo esc_attr( $time ); ?>">
        <input type="hidden" name="wpide_math_token" value="<?php echo esc_attr( $token ); ?>">
    </p>
    <?php
} );

add_filter( 'authenticate', function ( $user ) {
    // Only the wp-login.php form; XML-RPC, REST and other login forms are left alone.
    if ( 'wp-login.php' !== ( isset( $GLOBALS['pagenow'] ) ? $GLOBALS['pagenow'] : '' ) || empty( $_POST['log'] ) ) {
        return $user;
    }

    $answer = isset( $_POST['wpide_math'] ) ? (int) $_POST['wpide_math'] : -1;
    $time   = isset( $_POST['wpide_math_time'] ) ? (int) $_POST['wpide_math_time'] : 0;
    $token  = isset( $_POST['wpide_math_token'] ) ? sanitize_text_field( wp_unslash( $_POST['wpide_math_token'] ) ) : '';

    $valid = $time > time() - HOUR_IN_SECONDS && hash_equals( hash_hmac( 'sha256', $answer . '|' . $time, wp_salt( 'nonce' ) ), $token );

    return $valid ? $user : new WP_Error( 'wpide_math', '<strong>Error:</strong> Please answer the math question correctly.' );
}, 25 );
```

## Notes

Custom login forms (shop or membership plugins) do not show the question and are not checked.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Simple Math Question on the Login Form" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/