WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I created a login form in the frontend with wp_login_form(). In my functions.php file I added an action to prevent the redirect to /wp-login.php if the login failed with

add_action('wp_login_failed', ….

As it turns out the action only hooks if the username and password fields are filled in. If one of them is left empty I still get redirected to wp-login.php.

Is there a possibility to check if both fields are filled in to prevent the redirect?



share|improve this question

Add this filter to change how blank username/password is treated:

add_filter( 'authenticate', 'custom_authenticate_username_password', 30, 3);
function custom_authenticate_username_password( $user, $username, $password )
    if ( is_a($user, 'WP_User') ) { return $user; }

    if ( empty($username) || empty($password) )
        $error = new WP_Error();
        $user  = new WP_Error('authentication_failed', __('<strong>ERROR</strong>: Invalid username or incorrect password.'));

        return $error;

And then your original redirect on wp_login_failed will work with blank username/password as well.

share|improve this answer
really nice job...THx... – vrajesh Jun 23 '15 at 11:25

The problem lies with the function wp_authenticate() (found in the file pluggable.php)

You have 3 options.

  • hack the wordpress core (not advised!)
  • write your own plugin that overrides wp_authenticate() (this is merely deleting a few characters in an if statement).
  • use the plugin (not really worth the name plugin) I wrote. wp-login-failer
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.