I have several (client) sites that use security plugins that rewrite the standard wp-login.php access to something different, i.e. /myprivatelogin. (And yes, I know the issues about "obscurity is not security"; but this is not a security question).

Problem is that this login URL change breaks the functionality of using password protection for pages and posts, because WP redirects the password form on a passworded page/post to wp-login.php to verify the password before redirecting back to the page/post, and when wp-login.php doesn't exist, it breaks. The security plugins don't account for redirects to wp-login.php solely for passworded pages/posts; all URLs are redirected to i.e. myprivatelogin. The plugin devs don't appear to be interested in supporting passworded pages/posts.

What I'm trying to do is pretty hacky, but I'm thinking there is a way to get this to work. I want to redirect the submit form on passworded pages to a copy of the relevant code fromwp-login.php in my own file in the theme directory, have the password verified there and then be redirected back to the page/post.

The file wp-login.php handles all login work, and specifically for passworded pages/posts, uses the file wp-includes/class-phpass.php to decrypt and check the password before redirecting back to the page/post. See https://github.com/WordPress/WordPress/blob/master/wp-login.php

I have the first few steps working: I determine if a page/post has a password set by checking post_passwordon single.php and page.php, and if so, I load a jQuery function that rewrites the "post" URL of the form to my new login.php file in the theme directory, i.e.

class="post-password-form" method="post">

The form does submit to login.php, but that's where things break. I get a white screen and no errors are logged in debug. The URL stays at http://example.com/wp-content/themes/twentyfifteen/login.php with no redirect back to the page/post.

I assume the errors have to do with the functions wp_safe_redirect and wp_get_referer. Is this a "headers already sent" issue? Or the lack of an included core WP file?

This is my login.php and where the password entry form directs to on submit:


if ( array_key_exists( 'post_password', $_POST ) ) {
        wp_safe_redirect( wp_get_referer() );

    $hasher = new PasswordHash( 8, true );

     * Filters the life span of the post password cookie.

    $expire = apply_filters( 'post_password_expires', time() + 1 * DAY_IN_SECONDS );
    $referer = wp_get_referer();
    if ( $referer ) {
        $secure = ( 'https' === parse_url( $referer, PHP_URL_SCHEME ) );
    } else {
        $secure = false;
    setcookie( 'wp-postpass_' . COOKIEHASH, $hasher->HashPassword( wp_unslash( $_POST['post_password'] ) ), $expire, COOKIEPATH, COOKIE_DOMAIN, $secure );

    wp_safe_redirect( wp_get_referer() );


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.