Prevent wp_login_form() from redirecting to wp-admin when there are errors

Question

I have made a login form on the front-end of my site using wp_login_form(). However, when the user types in an incorrect username/password they are redirected to the wp-admin login form.

How can you instead display any error messages above the login form? Ideally, I don't want the user to ever have to see the Wordpress admin section.

I have tried using the redirect_invalid_login() hook but this doesn't seem to work?

Answer 1

just add the following code to your function.php. it will redirect back user from where the login form is submitted.

add_action( 'wp_login_failed', 'my_front_end_login_fail' );  // hook failed login

function my_front_end_login_fail( $username ) {
   $referrer = $_SERVER['HTTP_REFERER'];  // where did the post submission come from?
   // if there's a valid referrer, and it's not the default log-in screen
   if ( !empty($referrer) && !strstr($referrer,'wp-login') && !strstr($referrer,'wp-admin') ) {
      wp_redirect( $referrer . '?login=failed' );  // let's append some information (login=failed) to the URL for the theme to use
      exit;
   }
}

Answer 2

Here is what I did for anyone who has the same problem...

You can use the wp_login_failed hook as mentioned here, however this won't work if the user clicks login without entering a username and password.

To cover all errors you can copy the wp_authenticate() function located in wp-includes/pluggable.php and paste this in your themes functions.php file.

function wp_authenticate($username, $password) {
    $username = sanitize_user($username);
    $password = trim($password);

    $user = apply_filters('authenticate', null, $username, $password);

    if ( $user == null ) {
        $user = new WP_Error('authentication_failed', __('<strong>ERROR</strong>: Invalid username or incorrect password.'));
    }

    $ignore_codes = array('empty_username', 'empty_password');

    if (is_wp_error($user) && !in_array($user->get_error_code(), $ignore_codes) ) {

        // Put your code here

    }

    return $user;
}

You can then add you own code within if (is_wp_error($user) ... ) {.