I just found the answer: www.example.com/wp-login.php?redirect_to=url?action=rp&key=XXXXX&login=XXX contains the fragment ?redirect_to=url. Some plugin you have installed seems to add this using wp_login_url(‘url’);, which results in an incorrect formatting of the url. Used with wp_login_url() your problems should be fixed.
So here’s what we’re trying to do: IF A user logs in and is of a specific role ( Subscriber ) then redirect them to a specific page. IF A user tries to reach the admin panel, redirect them to a specific page. We’re going to use 3 hooks for the above problems: login_redirect – … Read more
This has been covered quite thoroughly here: https://wordpress.stackexchange.com/a/105224/62906 I’ve linked directly to the most informative and complete answer of the group (IMO).
There’s actually a show_admin_bar hook where you can always return true or false. I haven’t run across an issue where the admin bar is randomly disappearing though. Usually on my websites I like to turn it off for admins: /** * Remove Admin Bar For Administrators * Or anyone who can activate plugins */ function … Read more
The login process itself is not as important, it is a one time thing that with the right settings you can do once a year. What is important is the authentication cookies that are being sent. As long as they are not encrypted it doesn’t matter at all how much defense you put on the … Read more
Just customize the login URL with the login_url filter: https://gist.github.com/tripflex/ac477b59d20bd11c5856edcffc13e5ef add_filter( ‘login_url’, ‘smyles_custom_login_url’, 10, 3 ); /** * Filters the login URL. * * @since 2.8.0 * @since 4.2.0 The `$force_reauth` parameter was added. * * @param string $login_url The login URL. Not HTML-encoded. * @param string $redirect The path to redirect to on login, … Read more
please see this it working fine for me 🙂 function uop_login_redirect( $redirect_to, $request, $user ) { return ( is_array( $user->roles ) && in_array( ‘administrator’, $user->roles ) ) ? admin_url() : site_url(); } add_filter( ‘login_redirect’, ‘uop_login_redirect’, 10, 3 );
I know this thread is a little bit old, but as I spent 3 days installing, “up/down” VPS and searching Google, today I could find an answer to this error. On your WordPress installation root folder, find and open wp-login.php file. Search for the line $user = wp_signon(”, $secure_cookie); and replace the empty string ‘ … Read more
The problem here is a misunderstanding of what is_single means, reading the docs clarifies this: https://developer.wordpress.org/reference/functions/is_single/ Is the query for an existing single post? Description Works for any post type, except attachments and pages If the $post parameter is specified, this function will additionally check if the query is for one of the Posts specified. … Read more
Protecting only wp-admin won’t help a lot, at least it won’t protect your from brute-force attacks. A brute force attack is a trial-and-error method used to obtain information such as a user password or personal identification number (PIN). In a brute force attack, automated software is used to generate a large number of consecutive guesses … Read more