Login Form shortcode
Use web_login_form to display the theme's login form to guests and an optional message to signed-in visitors. New pages can use the Login Form block, which shares the same live output.
Usage
[web_login_form prepend="Sign in to your account." redirect_url="/account/" submit_button_style="1"]Hello {user_name}. <a href="{logout_link}">Log out</a>[/web_login_form]The signed-in message is enclosed content, not a content attribute. Empty enclosed content hides the component from signed-in visitors unless signed-in redirection is enabled. Guests still see the form.
Attributes
| Attribute | Default | Accepted values | Purpose |
|---|---|---|---|
prepend |
Empty | Safe inline rich text | Text above the guest form. |
append |
Empty | Safe inline rich text | Text below the guest form. |
redirect_url |
Empty | Local URL or a WordPress-approved redirect host | Destination after a successful login. Empty returns to the current page. |
redirect_when_logged_in |
Empty | true |
Redirect already signed-in visitors when a valid destination is set. |
login_error_message |
Translated “Invalid username or password.” | Plain text | Feedback for invalid credentials. |
submit_button_style |
1 |
Configured theme button-style key | Submit button presentation. An unavailable key falls back to the theme default. |
el_id |
Empty | Unique HTML ID | Container anchor, available in every mode. |
el_class |
Empty | Space-separated CSS classes | Existing helper classes on the container. |
There is no device-visibility attribute for this shortcode. Use a surrounding layout's visibility settings when necessary.
Visitor fields
Enclosed content supports {user_name}, {user_last_name}, {user_email}, {user_login}, {logout_link} and {my_account_link}. Use the URL placeholders as link destinations. The account URL is empty when no WooCommerce account page is configured; the form does not otherwise require WooCommerce. Fields resolve from the current visitor and are escaped before nested shortcodes run. Safe post HTML and nested theme shortcodes are supported, including their generated images, icons and controls; executable authored markup is rejected. Enclosed content runs only for signed-in visitors.
Behavior and verification
The form uses WordPress authentication with protected submissions. Errors appear only on the submitted instance. Unsafe redirects are rejected. Already-signed-in redirection uses the theme's shared script and provides a Continue link; the first redirecting instance takes precedence.
Guest login forms renew security tokens before submission, including the header form. Keep authenticated requests outside shared caches. After upgrading, refresh cached pages and scripts together. If renewal fails, use Reload and submit the current form again. See the block guide for verification steps.
Compare guest, invalid-login and signed-in behavior before publishing. The shortcode remains available when Page Builder administration is disabled and does not enqueue a dedicated login asset.