My goal: Redirect visitors who go to wp-login.php (or who try to register) to the homepage. But still allow wp-login.php to function during certain actions like logout, lostpassword, and for password resets.

We used the code in another question to get us almost there. (How to use wp-login.php page only for logout?)

Our modification adds the lostpassword and password reset actions. This is what we have now:

// Allow logout and lost password actions but redirect to the home page for all other wp-login.php requests

add_action( 'login_head', 'redirect_home_on_login_form' );
function redirect_home_on_login_form() {
       if ( ! isset( $_REQUEST['action'] ) || ('logout' !== $_REQUEST['action']  && $_REQUEST['action'] !== 'lostpassword' && $_REQUEST['action'] !== 'rp') ) {
        wp_redirect( home_url( '/' ) );

// wp_logout fires after the user's login cookies have been removed
add_action( 'wp_logout', 'redirect_home_on_logout' );
function redirect_home_on_logout() {
    wp_redirect( home_url( '/' ) );

Problem: This code does allow the required actions to function. But it isn't redirecting other visitors at wp-login.php to the home page. Instead it's giving us a blank gray page -- loading css but nothing else for the page.

The problem seems to be using login_head because we need this to kick in earlier.

We tried add_action with login_init instead, but that causes logins themselves not to process.

We tried do_action with login_init instead, and it lets us login and use the actions tied to wp-login.php, but it also doesn't redirect wp-login.php at all -- the form just loads as it should on default.

Any ideas on how to get this to work would be much appreciated. While the gray screen not loading the form at least stops brute force attacks there, I'd rather it keep normal visitors on the site if they happen to end up there for whatever reason.


1 Answer 1


Apparently after 2 days of trying to sort this out, all I needed to do was post here and then the solution would turn up so I could feel like an idiot. :)

I was able to tweak the response in this question (Disable Or Redirect WP-login.php) and finally get this to work.

If anyone else runs into the same problem, this is what worked for me to block the login and register page, but still allow logouts, lost password requests, and password reset forms to work.


function custom_login(){
 global $pagenow;
 if( 'wp-login.php' == $pagenow && $_GET['action']!="logout" && $_GET['action']!="lostpassword" && $_GET['action']!="rp") {
  wp_redirect( home_url( '/' ) );

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.