How do you log a user out with wp_logout?

Question

I can get wp_logout to work, but not without generating lots of warnings ('PHP warning: Cannot modify header information - headers already sent').

wp_logout calls wp_clear_auth_cookie, which calls setcookie, and the cookies have to go with the HTTP headers. I'm calling wp_logout inside the page (in the header or footer), hence the problem.

So, how exactly am I meant to programmatically log a user out? I could do this in response to an ajax request, but that seems way over the top. Thanks.

EDIT

Current code as follows:

add_action('wp_footer', 'fp_onload_php2');
function fp_onload_php2() {
   $slug = basename(get_permalink());
   if($slug != 'club-login')
      return;

   $jsmsg    = '';
   $loggedin = false;
   if(is_user_logged_in()) {
      $current_user = wp_get_current_user();
      $loggedin = $current_user->has_cap('customer');
   }

   if($loggedin && isset($_GET['logout'])) {
      wp_logout();
      $jsmsg    = 'You have been logged out.';
      $loggedin = false;
   } else if(!$loggedin && isset($_GET['logout']))
      $jsmsg = "You are not logged in.";

   if(!$loggedin)
      echo
         "<script type='text/javascript'> fp_onload_js2(0, '" . $jsmsg .
         "'); </script>\n";
   else
      echo
         "<script type='text/javascript'> fp_onload_js2(1, '" . $jsmsg .
         "'); </script>\n";
}  // fp_onload_php2()

Answer 1

If you're using wp_logout in your own code, its probably best to exit or wp_redirect immediately afterwards.

You can call wp_set_current_user(0) after wp_logout() to manually log the user out instantly, if you need to continue executing PHP but don't want the user to be logged in.

Answer 2

This isn't great, but seems to work. It's not as simple as calling wp_logout before any content is sent, because the user may or may not be logged out before the rest of the page loads (I don't understand this). In my case, the page contents depend on whether or not the user is actually logged in (the menus change, and some JS code is called to display content differently).

for this code, a logout request redirects to the login page, with a GET parameter of logout=1. This is tested on the login page, which then calls wp_logout, and redirects back to the login page with a GET parameter of logout=0, to force a refresh.

add_action('init', 'check_logout');

function check_logout() {
   if(!isset($_GET['logout']) || ($_GET['logout'] != '1'))
      return;

   // get_permalink() and $post are not available here, so:
   $path = parse_url($_SERVER["REQUEST_URI"], PHP_URL_PATH);
   if($path != "/login/")
      return;

   if(is_user_logged_in()) {
      wp_logout();
      header("Location: http://fubar.com/login/?logout=0");
      exit();
   } 
}  // check_logout()