FluentAuth Login Redirects Still Allow old WP Logins
I would've thought that setting up a login redirect would keep people from going to /wp-admin to login, or to /wp-login.php. That doesn't seem to be the case.
I'm using the FluentCommunity login page and my own Registration page for new signups. Since people can still get to the default WordPress login alternatives, that allows them to bypass my registration page and gain access.
Is this something we can get fixed?
William Beem I added below code snippet from support to fluentsnippet to make it work as you described:
//New Login redirect
// Redirect wp-login.php url
function redirect_wp_login() {
if (isset($_GET['action']) && in_array($_GET['action'], ['logout', 'lostpassword', 'rp'])) {
return;
}
if (strpos($_SERVER['REQUEST_URI'], 'wp-login.php') !== false) {
wp_redirect(home_url('/custom-page'));
exit;
}
}
add_action('init', 'redirect_wp_login');
Debo Ogunrinde Thanks, I'll try that out. For now, I found the WPS Hide Login plugin to make it work. It's not quite perfect, so I'll test your code on my site to check it out.
Debo Ogunrinde OK, found another resolution. I forgot I have Perfmatters, and it does what I want. I installed that plugin and configured the wp-admin and wp-login.php for visitors to go to my home page. It has one stupid bug that prevents anyone from logging out (sends to a bad URL), but I'll let their support team worry about that.
William Beem Awesome! glad you found something that worked for your use case.
Debo Ogunrinde You know what? Your code turned out to be the easiest and most effective solution. Perfmatters caused a problem on logout. I tried Wishlist Member and a few other plugins. Each one had a new headache.
Your code redirects the default login page to my FluentCommunity page, and it makes wp-admin not found. That prevents unauthorized registration, and it's all I needed. Many thanks!
Debo Ogunrinde Thank you for this! I Installed FluentSnippet, added your code and it works like a charm.
William Beem William Beem Not sure if this issue was resolved(?) Just curious if your registration page was created with a form builder. I'd like to avoid that situation if possible, so today I tested both login and login/signup pages for FluentCommunity and FluentAuth. When using the custom signup/login page in FluentCommunity, I can still access the standard Wordpress login/signup pages by typing wp-admin or wp-login in the URL. When using FluentAuth, I'm redirected to the correct FluentAuth login/signup page when I type wp-admin or wp-login in the URL. Password resets are also working as expected. the pages look identical and the setup is identical too, so the workaround for my community is NOT using the custom login page in FluentCommunity - I leave it set as "default". I use the Login/Signup Page Customizer in FluentAuth and it works perfectly.
Mel Brown Yes, I use Fluent Forms for my registration page because I need to charge for access. If I had a free registration, I'd just use FluentAuth.
By default, I had the same issue as you with people accessing the regular WP login pages. A developer at WP Manage Ninja gave me a piece of code that I use in FluentSnippets to prevent that from happening. Here is the code:
function redirect_wp_login() {
$allowed_actions = ['logout', 'lostpassword', 'rp', 'resetpass', 'register'];
if (
strpos($_SERVER['REQUEST_URI'], 'wp-login.php') !== false &&
(!isset($_GET['action']) || !in_array($_GET['action'], $allowed_actions))
) {
wp_redirect(home_url('/community/?fcom_action=auth'));
exit;
}}
add_action('init', 'redirect_wp_login');
William Beem Thanks for this.
Hi Debo Ogunrinde Mr. Beem shared this code with me and thank you for sharing it with the community. If you don't mind, I have a different question: I really love the styling FluentAuth offers for the default Wordpress System emails and I'd like to use that styling in my business. My problem is the styled emails can only be sent if the user is created in FluentAuth. If the user is created outside of FluentAuth - (in FluentForms or FluentCRM for example), the styled email in FluentAuth is not triggered. Instead, the standard Wordpress email is sent. Access to my community is only after payment with Fluent forms or Paymattic. Is there any way to integrate FluentAuth into my signup flow (which is currently a Wordpress Sales Page -- Paymattic form -- FluentCRM -- FluentCommunity) so that I can take advantage of FluentAuth's excellent styling capabilities? I'm not seeing where the default Wordpress emails can be replaced by a template in FluentCRM(?) I hope this makes sense - I'm willing to clarify further if needed. Thanks in advance.
Mel Brown The code I shared was from WpManageNinja Support! I would suggest for you to reach out to them for your question....They have been very helpful to me...
Debo Ogunrinde question how does this suppose to work with the password reset page...i am noticing that it still goes to a wordpress page... should i create a password reset page myself?
Tambria Kemp I'm fighting with this, too. Worse, the password resets aren't working. After completing a password reset for a user in FCRM whose WordPress account was generated automatically, the password reset tells me there is a mismatch.
I have users on another platform that I need to import here. They're in FCRM, the user account generates, and I can even give them badges. The damn password reset gives an error.