How to Send All Logins to the WordPress Login Page

Sunshine has its own login form so your customers can sign in right on your gallery site instead of being sent to the WordPress login screen. That works well for clients, but it means those logins skip wp-login.php entirely.

That matters if anything on your site is attached to the WordPress login screen, because Sunshine's form signs people in on its own without ever going there. Common reasons to want every login going through WordPress instead:

• Two-factor authentication. These plugins add their second step to the WordPress login screen, so it never appears for a Sunshine login.
• Single sign-on. Google, Microsoft, or other "sign in with" buttons live on the WordPress login screen.
• Login security plugins. Brute force protection, failed login limits, and CAPTCHA usually only cover wp-login.php.
• Activity logs and audit trails. If you need a record of every login, one screen is easier to trust than two.
• One login screen for everyone. Some photographers just want staff and clients signing in the same place, especially if the login screen is already branded to match the site.

The code below sends every login there.

What This Snippet Does

There are four ways someone can reach a Sunshine login form. The snippet handles all of them:

• Changes the Login link in the Sunshine menu so it goes to the WordPress login page, and removes the Sign Up link
• Redirects the account page to the WordPress login page when a visitor is not signed in
• Redirects galleries set to "Require an account" to the WordPress login page
• Replaces the login and signup popups with a button that links to the WordPress login page

It also turns off Sunshine's login processing entirely. So even if a login form shows up somewhere the snippet missed, or someone tries to send a password straight to your site, nothing signs them in. They get a message with a link to the right screen instead.

After signing in, people land back on the page they came from.

The Code

Add this to your site as one snippet.

/**
 * Send every Sunshine login through the WordPress login page.
 */

// The login URL to use, returning people to where they were afterward.
function my_sunshine_login_url( $redirect_to = '' ) {
    if ( empty( $redirect_to ) ) {
        if ( wp_doing_ajax() ) {
            // During a popup request the current URL is admin-ajax.php, so use the page they came from.
            $redirect_to = wp_get_referer();
        } elseif ( ! empty( $_SERVER['HTTP_HOST'] ) && ! empty( $_SERVER['REQUEST_URI'] ) ) {
            $redirect_to = ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
        }
    }
    return wp_login_url( $redirect_to );
}

// 1. Swap the Login link in the Sunshine menu, and remove Sign Up.
add_filter( 'sunshine_main_menu', 'my_sunshine_menu_login_link', 20 );
function my_sunshine_menu_login_link( $menu ) {

    if ( is_user_logged_in() || ! is_array( $menu ) ) {
        return $menu;
    }

    if ( isset( $menu[100] ) ) {
        $menu[100] = array(
            'name'  => __( 'Login', 'sunshine-photo-cart' ),
            'url'   => my_sunshine_login_url(),
            'class' => 'sunshine--login',
        );
    }

    unset( $menu[110] ); // Sign Up

    return $menu;

}

// 2. Redirect the account page and account-only galleries to the login page.
add_action( 'template_redirect', 'my_sunshine_redirect_to_wp_login' );
function my_sunshine_redirect_to_wp_login() {

    if ( is_user_logged_in() || ! function_exists( 'SPC' ) ) {
        return;
    }

    // Let password reset links from older Sunshine emails still work.
    if ( isset( $_GET['key'] ) && isset( $_GET['login'] ) ) {
        return;
    }

    $gallery = SPC()->frontend->current_gallery;
    if ( is_sunshine_page( 'account' ) || ( ! empty( $gallery ) && 'account' == $gallery->get_access_type() ) ) {
        wp_safe_redirect( my_sunshine_login_url() );
        exit;
    }

}

// 3. Replace the login and signup popups with a link to the login page.
add_action( 'init', 'my_sunshine_replace_login_modals' );
function my_sunshine_replace_login_modals() {
    $hooks = array( 'login', 'signup', 'require_login', 'guest_favorites' );
    foreach ( $hooks as $hook ) {
        remove_action( 'sunshine_modal_display_' . $hook, 'sunshine_modal_display_' . $hook );
        add_action( 'sunshine_modal_display_' . $hook, 'my_sunshine_login_modal' );
    }
}

function my_sunshine_login_modal() {
    $url   = my_sunshine_login_url();
    $html  = '<div class="sunshine--modal--title">' . esc_html__( 'Login', 'sunshine-photo-cart' ) . '</div>';
    $html .= '<p><a class="button sunshine--button" href="' . esc_url( $url ) . '">' . esc_html__( 'Continue to login', 'sunshine-photo-cart' ) . '</a></p>';
    wp_send_json_success( array( 'html' => $html ) );
}

// 4. Refuse any login that still tries to come through Sunshine.
add_filter( 'sunshine_login_validation', 'my_sunshine_block_front_end_login' );
function my_sunshine_block_front_end_login() {
    return sprintf(
        /* translators: %1$s: opening link tag, %2$s: closing link tag */
        __( 'Please %1$slog in through the WordPress login page%2$s.', 'sunshine-photo-cart' ),
        '<a href="' . esc_url( my_sunshine_login_url() ) . '">',
        '</a>'
    );
}

Learn how to add this custom code to your WordPress website

What Your Customers Will See

The Login link in the gallery menu takes them straight to the WordPress login screen. It no longer opens a popup.

When they sign in, they come back to the gallery page they were on, not the WordPress dashboard.

If they open a gallery you have set to require an account, they go to the login screen automatically and return to that gallery once they are signed in.

If they click something that used to open a login popup, like buying a photo when purchases require an account, the popup now shows a single Continue to login button.

Things to Know Before You Use It

Sign Up disappears. Customers can no longer create their own account from your gallery site. You can create accounts for them under Users in the WordPress admin, or let them register through WordPress if you allow that. If you would rather keep Sunshine's signup form, delete this line from part 1:

    unset( $menu[110] ); // Sign Up

Learn how to add this custom code to your WordPress website

"Continue as guest" disappears from the favorites popup. If you use guest favorites and want to keep that option, remove 'guest_favorites' from the list in part 3:

    $hooks = array( 'login', 'signup', 'require_login' );

Learn how to add this custom code to your WordPress website

Password resets go through WordPress. Customers use the "Lost your password?" link on the WordPress login screen. Reset links already sent from Sunshine emails still work.

The WordPress login screen looks different from your gallery site. You can add your own logo and colors to it. See How to Customize the Logo on the Login Screen.

Gallery passwords are not affected. A gallery protected by a password or an email address does not use a WordPress account, so it keeps working exactly as before.

Keeping Only Staff on the WordPress Login

Often the reason for all this only applies to your own account, and there's no need to make clients give up the easy inline form. If that's your situation, skip parts 1 through 3 and use this version of part 4 by itself. It blocks anyone who can get into the WordPress admin, and lets customers sign in normally.

add_filter( 'sunshine_login_validation', 'my_sunshine_block_staff_login', 10, 2 );
function my_sunshine_block_staff_login( $error, $data ) {

    if ( ! empty( $error ) ) {
        return $error;
    }

    // The popup sends "email", the regular form sends "sunshine_login_email".
    $email = ! empty( $data['email'] ) ? $data['email'] : ( isset( $data['sunshine_login_email'] ) ? $data['sunshine_login_email'] : '' );
    $user  = get_user_by( 'email', sanitize_email( $email ) );

    if ( $user && user_can( $user, 'edit_posts' ) ) {
        return sprintf(
            /* translators: %1$s: opening link tag, %2$s: closing link tag */
            __( 'Staff accounts must %1$slog in through the WordPress login page%2$s.', 'sunshine-photo-cart' ),
            '<a href="' . esc_url( wp_login_url() ) . '">',
            '</a>'
        );
    }

    return $error;

}

Learn how to add this custom code to your WordPress website

This catches administrators, editors, authors, and Sunshine Managers. Change edit_posts to manage_options if you only want to block full administrators.