How to add custom login forms in WordPress
You can add a basic custom login page without a plugin by placing WordPress’s built-in login form function in a page template. Use a plugin when you need CAPTCHA, custom fields, visual form building or simpler post-login redirects.
- 01Choose the login page behaviour
- 02Create a dedicated login page
- 03Display the built-in form
- 04Add the redirect rule if needed
- 05Style and protect the page
- 06Use a form plugin for the fast way
What you need
- A WordPress site with a child theme or code-snippet method
- Administrator or developer access
- A destination page for logged-in users
Choose the login page behaviour
Decide where the form should send people after they log in. A membership site might use /members/, while an LMS might use a dashboard or course library. Keep the destination on your own site.
For a simple front-end login page, you do not need to replace WordPress authentication. You only need to display a form that submits to WordPress’s normal login process.
Create a dedicated login page
Create a page such as Log in with a short explanation and links to password recovery and registration. Note its URL, for example https://example.com/login/.
If your site uses a block theme, create a small page template in a child theme or use a shortcode supplied by a form plugin. Do not paste PHP directly into the page editor.
Display the built-in form
In a child-theme page template, place <?php wp_login_form( array( 'redirect' => home_url( '/members/' ), 'remember' => true, 'label_username' => 'Username or email' ) ); ?> where the form should appear. Assign that template to your login page.
wp_login_form() outputs a standard WordPress login form and accepts an absolute redirect URL. It sends the credentials to WordPress’s normal login endpoint rather than requiring you to write authentication code.
Add the redirect rule if needed
The form’s redirect argument is enough when every user goes to the same destination. If administrators, members and students need different destinations, add a login_redirect filter in a child theme or site-specific plugin and inspect the supplied user object before returning a local URL. WordPress documents this filter as the place to change the login redirect.
Use wp_safe_redirect() for custom redirects and stop execution afterwards when writing your own redirect logic. Avoid accepting an unchecked URL from a form field, because that can create an open redirect.
Style and protect the page
Use your theme’s CSS to style the form, labels, buttons and error messages. The built-in function provides basic fields, remember-me support and labels, but it does not turn the page into a full membership form builder or add CAPTCHA by itself.
Keep HTTPS enabled, add rate limiting or CAPTCHA if the page is public, and retain links for password recovery. Do not try to block wp-login.php globally: the custom form submits there, and WordPress also uses that endpoint for administrator access and password-related actions. Blocking it is a common cause of forms that appear to submit but never log users in.
Use a form plugin for the fast way
For a visual form with CAPTCHA and configurable redirects, use JetFormBuilder User Login Action. Build the form in JetFormBuilder, add its post-submit user login action, choose the redirect, and place the resulting form on your login page.
This is the faster route when you do not want to maintain a child-theme template or custom redirect code, or when your membership site needs more than username, password and remember-me fields.
Let JetFormBuilder User Login Action do it
JetFormBuilder post-submit login action with redirects and CAPTCHA, for sites needing custom authentication forms rather than default WordPress login.
Sources
- developer.wordpress.org /reference/functions/wp_login_form/?utm_source=openai
- developer.wordpress.org /reference/hooks/login_redirect/?utm_source=openai
- developer.wordpress.org /reference/functions/wp_safe_redirect/?utm_source=openai
- wordpress.org /support/topic/wp-admin-and-wp-login-php-redirect/?utm_sourc…
Questions
- Can I create a custom WordPress login form without a plugin?
- Yes. Add WordPress’s built-in <code>wp_login_form()</code> function to a child-theme page template and assign that template to a page. It creates the form and sends credentials through WordPress’s normal login process. This is suitable for a branded basic login page, but you will need extra code or another tool for CAPTCHA, registration fields, conditional redirects and advanced validation.
- Why does my custom login form reload without logging in?
- The usual cause is code that redirects or blocks <code>wp-login.php</code>, which is the endpoint used by the built-in front-end form. Check redirect plugins, security rules, caching and custom code before changing the form itself. Also confirm that the site uses HTTPS consistently and that cookies are not being blocked. Test the same credentials through the standard WordPress login page to isolate the problem.
- How do I redirect users after they log in?
- Pass an absolute URL through the <code>redirect</code> argument of <code>wp_login_form()</code> when everyone should go to the same page. For role-based destinations, use WordPress’s <code>login_redirect</code> filter and inspect the user parameter before returning a local destination. Do not trust an arbitrary redirect URL supplied by visitors; use safe, known paths on your own site.
- Should I hide or disable wp-login.php after creating a custom login page?
- No. A custom page changes where people see the form, but WordPress still needs its normal login endpoint for form processing, password recovery and administrative access. Blocking that endpoint can break the custom form and lock out administrators. If you want more protection, use HTTPS, CAPTCHA or rate limiting, strong passwords and two-factor authentication instead of relying only on a hidden login URL.