Restrict Access to wp-login.php

Question

I have a hard coded login/register/lost password form in the sidebar of my theme. I am using hidden input for "redirect_to" which is working fine. But when I press login button without entering anything or specifically when an error occurs, it redirects to wp-login.php page.

I dont want this to happen. If an error occurs it should show in the current place. How can i do this.

Note: Same is required for the logout function. Basically, I dont want to show wp-login.php page at any cost to anyone.

Answer 1

The action wp_login_failed fires when there's a failed login due to a faulty username/password combination. So that's a good place to start. This is a super simple example that just redirects to the home page.

<?php
add_action( 'wp_login_failed', 'wpse25628_login_failed', 10, 1 );
/**
 * Catches all failed logins and redirect them to the 
 * websites home page.
 */
function wpse25628_login_failed( $username )
{
    /*
    May want to do something here to give the user feedback
    for instance call `global $user;`, which will be a
    wp_error object, you could append the code as a 
    $_GET variable and adjust your front end according to the
    error message
    */
    wp_redirect(
        home_url(),
        302
    );
    exit();
}

And, of course, there's a wp_logout hook as well! Maybe you send folks a thank you page here instead of the home page.

<?php
add_action( 'wp_logout', 'wpse25628_catch_logout' );
/**
 * When a user logs out, send them back to the home page
 */
function wpse25628_catch_logout()
{
    wp_redirect(
        home_url(),
        302
    );
    exit();
}

Unfortunately, the wp_login_failed hook does not fire if there's an empty username or password. Also equally unfortunate is the lack of hooks that get fired when a that happens. It's probably better to validate that sort of thing on the client side with javascript. Here's a quick example.

jQuery(document).ready(function(){
    jQuery('#loginform').submit(function(e){
        var errors;
        jQuery('#loginform input').each(function(){
            var val = jQuery(this).val()
            if( ! val )
            {   
                errors = true;
            }
        });
        if( errors )
        {
            e.preventDefault();
        }
    });
});

Answer 2

You can redirect away from wp-login and other default pages this way:

add_action('plugins_loaded', 'myAction');
function wpSimpleUserSetup() {
    if (in_array($_SERVER['REQUEST_URI'], array('/wp-login.php', 'wp-login.php?action=register'))) {
        wp_redirect(wp_login_url());
        exit;
    }
}

Moreover, the wp_login_url() function is pluggable so you can actually override it with your own:

function myLoginUrl( $redirect = '', $force_reauth = false ) {
    return $custom_url;
}
add_filter( 'login_url', 'myLoginUrl', 9999 );