I want to be able to create custom login errors.

For instance if a user visits a restricted area without being logged in then I am redirecting to wp-login.php?ref=access and I would like to output Restricted area, please login to continue. or something similar.

Any idea how to do this. I found that there are filters for login_errors but I can't find anywhere else in the code this comes up, except in the login page itself.

Lastly, I really don't want to have to change any of the core files to do this either. I've spent a lot of time and energy trying to make sure that the wordpress core is completely untouched so that I can upgrade it.

Anyone have any ideas?

Thank you



From quick look at the login screen code (ouch):


function ref_access() {

    global $error;

    if( !empty($_GET['ref']) && 'access' == $_GET['ref'] )
        $error  = 'Restricted area, please login to continue.';
  • oh, brilliant. :) Thank you. How the hell did you figure that out?! :p Thanks a lot rarst. – Thomas Clayson Apr 8 '11 at 9:55
  • @Thomas Clayson see the code of login_header() function. It expects error passed (which would probably require you to add and process custom action, messy) but it also checks that global $error variable which is trivial to change as you see. :) – Rarst Apr 8 '11 at 10:11
  • Please have a look at @Meitar's solution bellow which is way cleaner. – Tristan CHARBONNIER Feb 24 '18 at 10:39

A brief update. As of WordPress version 3.6, using a global variable like Rarst suggests is very messy and it will clobber any other core, plugin, or theme error messages stored in that variable.

The global error variable to which Rarst refers is actually a WP_Error object which is itself responsible for collating errors from various events across WordPress's invocation lifecycle. So please do not clobber its values, that makes debugging very hard.

Instead, use the wp_login_errors filter (not login_errors) and add() errors there. Like this:

add_filter('wp_login_errors', 'my_custom_errors');
function my_custom_error ($errors) {
    if ('access' === $_GET['ref']) {
        $errors->add('access', 'Restricted area, please login to continue.');
    return $errors;

(NOTE: This doesn't exactly answer your question.)

If I am not wrong, the login_errors filter that you are talking about is for displaying a message when a wrong username/password is entered.

So, by default, you'd be displayed this when you enter a wrong username:

ERROR: Invalid username.

And this for a wrong password:

ERROR: The password you entered for the username XXXXX is incorrect.

The thing is, you can use the login_errors filter to display a custom message:

function fake_error(){
    return 'SORRY, LOGIN DISABLED!';
add_filter( 'login_errors', 'fake_error' );

Generally, used as a security (through obscurity?) measure, used to prevent attacker from knowing whether he's entered a wrong username or a wrong password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.