27

Right now when I log out via:

<a href="<?php bloginfo('url'); ?>/wp-login.php?action=logout">Log out</a>

it redirects me to the page where I need to confirm the log out.

How to eliminate the confirmation and redirect to the homepage after logout?

6 Answers 6

44

This happens because you are missing the neccessary nonce in the URL, which is being checked in wp-login.php

case 'logout' :
    check_admin_referer('log-out');
    ...

Use wp_logout_url in order to retreive the URL including the nonce. If you want to redirect to a custom URL, simply pass it as an argument.

<a href="<?php echo wp_logout_url('/redirect/url/goes/here') ?>">Log out</a>

You could also use wp_loginout which generates the link for you including translation:

echo wp_loginout('/redirect/url/goes/here')
3
  • 1
    echo wp_loginout('/redirect/url/goes/here') is working fine.. Oct 30, 2015 at 5:32
  • 1
    I'm using wp_logout_url( get_permalink()) and the confirmation page is not bypassed. The nonce is generated as part of the URL but I am still sent to the confirmation page
    – Ralphonz
    Dec 17, 2018 at 10:42
  • Same issue here :( Apr 14, 2019 at 6:34
27

If you can't use wp_logout_url() function, You can turn off this validation using this code:

add_action('check_admin_referer', 'logout_without_confirm', 10, 2);
function logout_without_confirm($action, $result)
{
    /**
     * Allow logout without confirmation
     */
    if ($action == "log-out" && !isset($_GET['_wpnonce'])) {
        $redirect_to = isset($_REQUEST['redirect_to']) ? $_REQUEST['redirect_to'] : 'url-you-want-to-redirect';
        $location = str_replace('&amp;', '&', wp_logout_url($redirect_to));
        header("Location: $location");
        die;
    }
}

Replace 'url-you-want-to-redirect' with the URL you want to redirect after logout.

Add it in your functions.php

8
  • 1
    This works for logging out without validation, but it doesn't redirect to the url I want.
    – Phu Nguyen
    Jun 29, 2017 at 8:27
  • @PhuNguyen You just need to add the redirect URL to the redirect request in that code where there is ' ' quotes, after the colon.
    – NJENGAH
    Dec 17, 2017 at 6:01
  • are there any security implications for removing this validation?
    – rok
    Mar 20, 2018 at 0:21
  • @user1264304 I believe malicious JS somehow loaded into the browser could do a redirect to the login page, but all it's going to do is logout the user. Truly malicious code would probably seek to replace the URL before a valid nonce. The user could navigate to another site which then has a link the current site's logout page - assuming the other site is aware that the user has a relationship. Again, no consequence other than logging out the user. I've never seen this. So to answer your question, I do Not think there is a security implication for removing the validation.
    – TonyG
    May 4, 2018 at 15:47
  • Err, Too Many Redirects... Feb 5, 2019 at 16:49
12

If you create a custom link in your menu, set the label to “Logout”, and set the URL to http://yourdomain.com/wp-login.php?action=logout. Then add this function to your functions.php file:

function change_menu($items){
  foreach($items as $item){
    if( $item->title == "Logout"){
         $item->url = $item->url . "&_wpnonce=" . wp_create_nonce( 'log-out' );
    }
  }
  return $items;

}
add_filter('wp_nav_menu_objects', 'change_menu');

If you want to redirect to the login page after logout then you should append login URL as:

$item->url = $item->url . "&_wpnonce=" . wp_create_nonce( 'log-out' ).'&redirect_to='.wp_login_url();

Reference link

** tried that did not work. Really want to log out page then 4 something went wrong when clicking the button.

1

This worked for me by adding /?customer-logout=true at the end.

http://www.website.com/?customer-logout=true

1
  • 1
    This worked well for me, too... But maybe it can be used only if WooCommecre is installed... I don't know...
    – Aerendir
    Feb 4 at 12:23
1

If you're using roots/sage wordpress starter theme, or any other theme using Laravel's Blade templating engine, make sure not to escape the url:

// don't do
<a href="{{ wp_logout_url(get_permalink()) }}">log out</a>

// but instead
<a href="{!! wp_logout_url(get_permalink()) !!}">log out</a>

First example escapes all html characters, while the latter does not.

0

To bypass logout confirmation prompt define _wpnonce for log-out action in the URL like this:

$log_out_url = add_query_arg('_wpnonce', wp_create_nonce('log-out'), wp_logout_url());

wp_safe_redirect($log_out_url);
exit;

Not the answer you're looking for? Browse other questions tagged or ask your own question.