Action Hook since 1.5.1
wp_login
Fires after a user has successfully logged in
Description
wp_login fires only on a successful authentication — pair it with wp_login_failed to cover both outcomes.
When it runs
Right after credentials are validated, before the redirect to wp-admin or the requested page.
Signature
do_action( 'wp_login', string $user_login, WP_User $user );Parameters
$user_loginstring — Username of the user who logged in.$userWP_User — WP_User object of the logged-in user.
Examples
Basic
add_action( 'wp_login', function( $user_login, $user ) {
update_user_meta( $user->ID, 'last_login', current_time( 'mysql' ) );
}, 10, 2 );Record a last-login timestamp for every user.
Common Use Cases
- Track last login time
- Redirect users by role after login
- Log login events for security auditing
- Trigger welcome logic on first login
Common mistakes
- Assuming wp_login also covers failed attempts — use the separate wp_login_failed hook for that
Related hooks
FAQ
Does wp_login fire for REST API or application password logins?
No — it fires only for the standard wp_signon() cookie-based login flow, not REST authentication.
Source: wp-includes/user.php