Right now when I log out via:

<a href="<?php bloginfo('url'); ?>/wp-login.php?action=logout">Log out</a>

it redirects me to the page where I need to confirm the log out.

How to eliminate the confirmation and redirect to the homepage after logout?

up vote 21 down vote accepted

This happens because you are missing the neccessary nonce in the URL, which is being checked in wp-login.php

case 'logout' :
    check_admin_referer('log-out');
    ...

Use wp_logout_url in order to retreive the URL including the nonce. If you want to redirect to a custom URL, simply pass it as an argument.

<a href="<?php echo wp_logout_url('/redirect/url/goes/here') ?>">Log out</a>

You could also use wp_loginout which generates the link for you including translation:

echo wp_loginout('/redirect/url/goes/here')
  • echo wp_loginout('/redirect/url/goes/here') is working fine.. – Mayur Devmurari Oct 30 '15 at 5:32

If you can't use wp_logout_url() function, You can turn off this validation using this code:

add_action('check_admin_referer', 'logout_without_confirm', 10, 2);
function logout_without_confirm($action, $result)
{
    /**
     * Allow logout without confirmation
     */
    if ($action == "log-out" && !isset($_GET['_wpnonce'])) {
        $redirect_to = isset($_REQUEST['redirect_to']) ? $_REQUEST['redirect_to'] : 'url-you-want-to-redirect';
        $location = str_replace('&amp;', '&', wp_logout_url($redirect_to));
        header("Location: $location");
        die;
    }
}

Replace 'url-you-want-to-redirect' with the URL you want to redirect after logout.

Add it in your functions.php

  • This works for logging out without validation, but it doesn't redirect to the url I want. – Phu Nguyen Jun 29 '17 at 8:27
  • @PhuNguyen You just need to add the redirect URL to the redirect request in that code where there is ' ' quotes, after the colon. – NJENGAH Dec 17 '17 at 6:01
  • are there any security implications for removing this validation? – user1264304 Mar 20 at 0:21
  • @user1264304 I believe malicious JS somehow loaded into the browser could do a redirect to the login page, but all it's going to do is logout the user. Truly malicious code would probably seek to replace the URL before a valid nonce. The user could navigate to another site which then has a link the current site's logout page - assuming the other site is aware that the user has a relationship. Again, no consequence other than logging out the user. I've never seen this. So to answer your question, I do Not think there is a security implication for removing the validation. – TonyG May 4 at 15:47

protected by Community Nov 15 '17 at 8:47

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.