The action wp_login_failed
fires when there's a failed login due to a faulty username/password combination. So that's a good place to start. This is a super simple example that just redirects to the home page.
<?php
add_action( 'wp_login_failed', 'wpse25628_login_failed', 10, 1 );
/**
* Catches all failed logins and redirect them to the
* websites home page.
*/
function wpse25628_login_failed( $username )
{
/*
May want to do something here to give the user feedback
for instance call `global $user;`, which will be a
wp_error object, you could append the code as a
$_GET variable and adjust your front end according to the
error message
*/
wp_redirect(
home_url(),
302
);
exit();
}
And, of course, there's a wp_logout
hook as well! Maybe you send folks a thank you page here instead of the home page.
<?php
add_action( 'wp_logout', 'wpse25628_catch_logout' );
/**
* When a user logs out, send them back to the home page
*/
function wpse25628_catch_logout()
{
wp_redirect(
home_url(),
302
);
exit();
}
Unfortunately, the wp_login_failed
hook does not fire if there's an empty username or password. Also equally unfortunate is the lack of hooks that get fired when a that happens. It's probably better to validate that sort of thing on the client side with javascript. Here's a quick example.
jQuery(document).ready(function(){
jQuery('#loginform').submit(function(e){
var errors;
jQuery('#loginform input').each(function(){
var val = jQuery(this).val()
if( ! val )
{
errors = true;
}
});
if( errors )
{
e.preventDefault();
}
});
});