I created a login form in the frontend with wp_login_form(). In my functions.php file I added an action to prevent the redirect to /wp-login.php if the login failed with

add_action('wp_login_failed', ….

As it turns out the action only hooks if the username and password fields are filled in. If one of them is left empty I still get redirected to wp-login.php.

Is there a possibility to check if both fields are filled in to prevent the redirect?



2 Answers 2


Add this filter to change how blank username/password is treated:

add_filter( 'authenticate', 'custom_authenticate_username_password', 30, 3);
function custom_authenticate_username_password( $user, $username, $password )
    if ( is_a($user, 'WP_User') ) { return $user; }

    if ( empty($username) || empty($password) )
        $error = new WP_Error();
        $user  = new WP_Error('authentication_failed', __('<strong>ERROR</strong>: Invalid username or incorrect password.'));

        return $error;

And then your original redirect on wp_login_failed will work with blank username/password as well.

  • 1
    really nice job...THx...
    – vrajesh
    Jun 23, 2015 at 11:25

The problem lies with the function wp_authenticate() (found in the file pluggable.php)

You have 2 options.

  • hack the wordpress core (not advised!)
  • write your own plugin that overrides wp_authenticate() (this is merely deleting a few characters in an if statement).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.