Action Hook since 1.5.1

wp_login

Fires after a user has successfully logged in

Description

wp_login fires only on a successful authentication — pair it with wp_login_failed to cover both outcomes.

When it runs

Right after credentials are validated, before the redirect to wp-admin or the requested page.

Signature

do_action( 'wp_login', string $user_login, WP_User $user );

Parameters

  • $user_login string — Username of the user who logged in.
  • $user WP_User — WP_User object of the logged-in user.

Examples

Basic

add_action( 'wp_login', function( $user_login, $user ) {
    update_user_meta( $user->ID, 'last_login', current_time( 'mysql' ) );
}, 10, 2 );

Record a last-login timestamp for every user.

Common Use Cases

  • Track last login time
  • Redirect users by role after login
  • Log login events for security auditing
  • Trigger welcome logic on first login

Common mistakes

  • Assuming wp_login also covers failed attempts — use the separate wp_login_failed hook for that

Related hooks

FAQ

Does wp_login fire for REST API or application password logins?

No — it fires only for the standard wp_signon() cookie-based login flow, not REST authentication.

Source: wp-includes/user.php

Group wizard

One session: this hook, then each related_hooks entry. Walk it and tell us what to change.

wp_login → user_register → login_url

functions.php — wp_login
functions.php
PHP wp_login · Hook 1 of 3 · Step 1 of 6

Practice the wp_login WordPress action hook in our interactive sandbox — a VS Code-style editor with a step-by-step wp_login tutorial, add_action exercises, and instant feedback. No local WordPress install required.