Customize login and registration
Use this workflow to change login presentation, public access, redirects, registration sessions, and notification policy without locking administrators out.
Separate appearance from authentication
Modern Admin appearance styles the login page but does not change authentication. The modern Login & registration module is under Settings → POM Tweaks → White labelling → Login & registration. It controls messages, subscriber and registration redirects, registration sessions, notifications, and public access.
Configure the journey
- Keep an authenticated administrator session open in a separate browser.
- For visual branding, open Settings → POM Tweaks → White labelling → Admin appearance and configure the login logo, background, form, links, labels, inputs, buttons, and contrast.
- Open White labelling → Login & registration, enable the module, and select its individual options. Add Login form message only for public instructions that are safe to show before authentication.
- Use the custom login error setting when a consistent error is required. Test invalid username and invalid password cases without exposing account existence.
- Enable Require login to view the site only after listing every public page, feed, integration, and callback that must remain reachable.
- Enable Redirect subscribers to the home page after login when accounts whose only role is Subscriber should land on the home page after login.
- For native single-site registration, enable Redirect users after registration and choose Registration destination page in the same module. Select a published page without password protection, then decide separately whether Log users in after registration is appropriate. Multisite signup and activation are unaffected.
- Review notification recipients before suppressing messages: the new-user option suppresses both administrator and user core emails for public registration; the password-reset option suppresses only the administrator notification. The new-user email normally carries the password setup link.
Verify every branch
Use a private browser window and disposable accounts:
- Load the login form signed out and check keyboard navigation, recovery links, errors, and responsive layout.
- Test a failed login and a successful administrator login.
- Test a successful subscriber login and confirm its destination.
- Register a new account, confirm whether a session is created, and verify the configured registration destination.
- Change a password and record which notifications each recipient receives.
- Log out and confirm that the public site follows the intended access policy.
If a redirect loop or inaccessible login form appears, disable the access or redirect component from the existing administrator session before changing visual settings.