While coding a custom login page, one needs to take care of the errors, else WordPress would redirect the page to /wp-admin or wp-login.php on wrong passwords or empty credentials. Please follow the below to solve this issue:--
Please use the below in your theme's functions.php file:-
/**
* Function Name: front_end_login_fail.
* Description: This redirects the failed login to the custom login page instead of default login page with a modified url
**/
add_action( 'wp_login_failed', 'front_end_login_fail' );
function front_end_login_fail( $username ) {
// Getting URL of the login page
$referrer = $_SERVER['HTTP_REFERER'];
// if there's a valid referrer, and it's not the default log-in screen
if( !empty( $referrer ) && !strstr( $referrer,'wp-login' ) && !strstr( $referrer,'wp-admin' ) ) {
wp_redirect( get_permalink( LOGIN_PAGE_ID ) . "?login=failed" );
exit;
}
}
/**
* Function Name: check_username_password.
* Description: This redirects to the custom login page if user name or password is empty with a modified url
**/
add_action( 'authenticate', 'check_username_password', 1, 3);
function check_username_password( $login, $username, $password ) {
// Getting URL of the login page
$referrer = $_SERVER['HTTP_REFERER'];
// if there's a valid referrer, and it's not the default log-in screen
if( !empty( $referrer ) && !strstr( $referrer,'wp-login' ) && !strstr( $referrer,'wp-admin' ) ) {
if( $username == "" || $password == "" ){
wp_redirect( get_permalink( LOGIN_PAGE_ID ) . "?login=empty" );
exit;
}
}
}
// Replace my constant 'LOGIN_PAGE_ID' with your custom login page id.
and the below in the custom login page file to show the corresponding errors:--
<div class="wp_login_error">
<?php if( isset( $_GET['login'] ) && $_GET['login'] == 'failed' ) { ?>
<p>The password you entered is incorrect, Please try again.</p>
<?php }
else if( isset( $_GET['login'] ) && $_GET['login'] == 'empty' ) { ?>
<p>Please enter both username and password.</p>
<?php } ?>
</div>