wp-login.php uses $_REQUEST['redirect_to'] as a way to override redirection for lostpassword link. However, it doesn't seem to work for some reason. Maybe its my server environment, but $_REQUEST['redirect_to'] value is unset even if I explicitly pass it as a GET variable in the URI.

Is this a wordpress thing or something possibly with my hosting environment or just me being a newb?

I saw another post where user @rarst mentioned WP implements its own logic behavior to enforce REQUEST as a combo of GET and POST. But I don't see the code he's talking about anywhere in wp-login and not in wp-load, either. So I'm guessing that REQUEST on wp-login behaves however the php environment is configured for it to behave.

Anyone have some insight on this?


The redirect_to variable works fine, even as a GET variable, however wp-login.php also uses wp_safe_redirect() for doing the actual redirection, which means that the URL must be on the same website. You can't redirect to anywhere in the web, just to the same site as the login is located on. This is to prevent some sorts of XSS issues.

| improve this answer | |
  • Thanks, Otto. I'm glad it works fine for someone else, so I know I'm not crazy or something. But no matter what I did, it wouldn't work. I tested super hardcore and I got other variable names to work fine but redirect_to always showed up as an empty string. I thought maybe it was being overridden by a cookie, but I couldn't find that to be the case. I'm pretty unfamiliar with cookies, though. I ended up doing a work-around that I wasn't fond of. – JamesHoux Nov 11 '12 at 7:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.