The following function that we have in a plugin a developer helped us create (he is no longer available) is giving errors when debugging is on once we updated the site from WP 4.9 to WP 5.3. Wondering if anything obvious is incorrect or deprecated now?

    add_action( 'wp_login_failed', array( $this, 'handle_failed_login' ) );     

    function handle_failed_login() {
    $referrer = $_SERVER['HTTP_REFERER']; 
    if ( ! empty( $referrer ) && ! strstr( $referrer,'wp-login' ) && !strstr( $referrer,'wp-admin' ) ) {
        $url = $this->parse_build_failed_login_url( $referrer );
        wp_redirect( $url ); 

    function parse_build_failed_login_url( $url ){ 
    $parsed_url = parse_url( $url );
    $url = ( isset( $parsed_url['scheme'] ) ) ? $parsed_url['scheme'] .'://' : '';
    $url .= ( isset( $parsed_url['host'] ) ) ? $parsed_url['host'] : '';
    $url .= ( isset( $parsed_url['path'] ) ) ? $parsed_url['path'] : '';
    $url .= '?login=failed#disclaimer-wrap';
    return $url;

The error we get is:

Warning: Cannot modify header information - headers already sent by (output started at /path-to-our-plugin:line#) in /wp-includes/pluggable.php on line 961-970, 973-976, 979-982, 985

The code in pluggable.php appears to be setting or clearing authentication cookies. The line # referenced in the error is the '$referrer = $_SERVER...' line.

The function is to stop the default redirection to the basic WordPress login error page (/wp-login.php) when a user enters incorrect login credentials on the login form we include on certain pages. These pages require a login to access a download, and we have login errors remaining on the page, not redirecting away. We're basically keeping the login process inline on page, not on a separate default WP page.

When debugging is 'false', the action does seem to still work correctly, but I don't want to ignore the errors if important.

  • 1
    There isn't enough information to answer or debug this, when and how handle_failed_login is called is super critical to debugging this, but also, if any output of any kind is sent, then the HTTP header is sent, and once it's sent it's sent, you can't call it back. That means a function like wp_redirect which sends a redirect header can't work. Think of it like trying to board a train after it's already left the train station. No matter how much you're told to do it the train has already left. It could even be the output of an earlier warning doing it – Tom J Nowell Dec 17 '19 at 1:01
  • @TomJNowell - Understood. Was trying to keep the code simple. I added the action, which is called by 'wp_login_failed'. So this kicks in when a username or password entered in the login fields, which is a default WP login embedded on page, are incorrect. I was mostly wondering why WP 5.3 suddenly caused these errors (they are not present on WP 4.9.x). – Kenny J Dec 17 '19 at 3:18
  • @KennyJ there is no output apart from wp_redirect in this code, which is why Tom is saying there is not enough to debug this. try including parse_build_failed_login_url and specifying which line numbers in your plugin the error code is referring to. otherwise is probably is a plugin conflict where another plugin is generating output (other than headers) with WP 5.3 so you might have to deactivate them to test this out. To be more specif the "Headers are already sent" message only happens when there is content output after the first (auth) headers, so that your redirect header won't work. – majick Dec 17 '19 at 5:41
  • @majick - Sorry, wish I was more proficient here. I added the 'parse_build_failed_login_url function, and clarified which specific line is being referenced by the error. NOTE: The error does not actually come up on the pages with the embedded login form where the actions are taking place, but rather only when going to '/wp-admin' (which does a redirect to 'wp-login.php?redirect_to=https-ourdomain.net%2Fwp-admin%2F&reauth=1'). The other file referenced is '/wp-includes/pluggable.php'. – Kenny J Dec 17 '19 at 20:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.