I have a form that hooks into admin_post_nopriv, after this hook has completed, the user is logged in. Now, there is a bug that occurs when the user has this form open in two separate tabs, completes the first form and posts it, and then completes the second form and posts it.

It simply redirects to https://example.com/wp-admin/admin-post.php showing a blank page. This is because after the user has been automatically logged in, the admin_post_nopriv hook no longer works.

How can I make sure that no one is able to access admin-post.php directly like this? Ideally, I would just redirect people away from that URL unless it's being called by POST action.

1 Answer 1


I don’t think that disabling admin-post.php is a good idea. Such solution may break WP, some plugins and themes.

But there is another, much simpler solution. Just add your action for admin_post (without nopriv) and process it properly - so if it’s a login action and user is already logged in, redirect him to proper url...

  • That was the second option I was thinking about. It seems rather counter-intuitive though, especially considering the role that these two admin_post hooks have. It might as well have been one hook if I'm going to have to use them both everywhere.
    – Swen
    Jan 27, 2019 at 13:55
  • It’s not counter intuitive. If you write your custom login form, you always have to process the case when user is already logged in - it’s a standard edge case. You can’t restrict such requests... Jan 27, 2019 at 13:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.