I created a login form in the frontend with wp_login_form(). In my functions.php file I added an action to prevent the redirect to /wp-login.php if the login failed with

add_action('wp_login_failed', ….

As it turns out the action only hooks if the username and password fields are filled in. If one of them is left empty I still get redirected to wp-login.php.

Is there a possibility to check if both fields are filled in to prevent the redirect?




Add this filter to change how blank username/password is treated:

add_filter( 'authenticate', 'custom_authenticate_username_password', 30, 3);
function custom_authenticate_username_password( $user, $username, $password )
    if ( is_a($user, 'WP_User') ) { return $user; }

    if ( empty($username) || empty($password) )
        $error = new WP_Error();
        $user  = new WP_Error('authentication_failed', __('<strong>ERROR</strong>: Invalid username or incorrect password.'));

        return $error;

And then your original redirect on wp_login_failed will work with blank username/password as well.

| improve this answer | |
  • 1
    really nice job...THx... – vrajesh Jun 23 '15 at 11:25

The problem lies with the function wp_authenticate() (found in the file pluggable.php)

You have 2 options.

  • hack the wordpress core (not advised!)
  • write your own plugin that overrides wp_authenticate() (this is merely deleting a few characters in an if statement).
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.