Auth

Login, logout, and every capability check in between runs through these hooks. Get them wrong and you either lock out legitimate users or leave a security hole — this group is where most custom auth logic actually lives. 3 actions, 2 filters in this category.

user_register WordPress action hook — Fires immediately after a new user is registered — user_register fires right after wp_insert_user() writes the row — the account exists but you're still inside the registr… — user_register

wp_logout WordPress action hook — Fires after a user logs out — wp_logout is the mirror of wp_login — use it to clear per-user cookies, caches, or add custom redirect logic. — wp_logout

`login_url`

auth

Filters the login page URL

login_url is how membership and white-label sites hide wp-login.php. Return a full URL, not a path fragment.

Signature

apply_filters( 'login_url', string $login_url, string $redirect, bool $force_reauth );

Example

add_filter( 'login_url', function( $url ) {
    return home_url( '/my-login/' );
} );

Common Use Cases

Custom login page URL
Hide wp-login.php from bots
Membership site login flow
White-label WordPress projects

since 2.8.0wp-includes/general-template.php

Read more WP Docs

`wp_login`

auth

Fires after a user has successfully logged in

wp_login fires only on a successful authentication — pair it with wp_login_failed to cover both outcomes.

Signature

do_action( 'wp_login', string $user_login, WP_User $user );

Example

add_action( 'wp_login', function( $user_login, $user ) {
    update_user_meta( $user->ID, 'last_login', current_time( 'mysql' ) );
}, 10, 2 );

Common Use Cases

Track last login time
Redirect users by role after login
Log login events for security auditing
Trigger welcome logic on first login

since 1.5.1wp-includes/user.php

Read more WP Docs

`user_register`

auth

Fires immediately after a new user is registered

user_register fires right after wp_insert_user() writes the row — the account exists but you're still inside the registration request, which matters for redirects and emails.

Signature

do_action( 'user_register', int $user_id, array $userdata );

Example

add_action( 'user_register', function( $user_id ) {
    $user = new WP_User( $user_id );
    $user->set_role( 'subscriber' );
    wp_mail( $user->user_email, 'Welcome!', 'Thanks for registering.' );
} );

Common Use Cases

Send welcome emails
Assign a default role
Sync new users to a CRM/mailing list
Set default user meta on signup

since 2.0.0wp-includes/user.php

Read more WP Docs

`wp_logout`

auth

Fires after a user logs out

wp_logout is the mirror of wp_login — use it to clear per-user cookies, caches, or add custom redirect logic.

Signature

do_action( 'wp_logout', int $user_id );

Example

add_action( 'wp_logout', function( $user_id ) {
    delete_transient( 'user_session_' . $user_id );
} );

Common Use Cases

Clear custom cookies or transients on logout
Log a security/audit event
Redirect to a custom page after logout
Invalidate a cached per-user fragment

since 1.5.1wp-includes/pluggable.php

Read more WP Docs

`authenticate`

auth

The core WordPress login/authentication filter

authenticate is the chain that decides whether login credentials are valid — every auth method, from core's own password check to SSO plugins, hooks into this same filter.

Signature

apply_filters( 'authenticate', WP_User|WP_Error|null $user, string $username, string $password );

Example

add_filter( 'authenticate', function( $user, $username ) {
    if ( 'blocked_user' === $username ) {
        return new WP_Error( 'blocked', 'This account is disabled.' );
    }
    return $user;
}, 30, 3 );

Common Use Cases

Add a second authentication factor before allowing login
Block specific usernames or patterns
Integrate an SSO/external identity provider
Log failed or suspicious login attempts

since 2.8.0wp-includes/user.php

Read more WP Docs