WordPress login & onboarding

Stop making logout look like something went wrong

Redirect After Logout sends each role to a page or URL of your choosing right after they sign out, instead of WordPress's default return to the login form — which reads like an error and nudges people straight back into signing in again.

  • A different destination per role, page or custom URL.
  • The most privileged role wins automatically for multi-role users.
  • Works correctly for custom roles, not a hardcoded hierarchy.
  • Send customers back to the site instead of a login screen.
Per-Role DestinationsRedirect After Logout

Administrator

PageCustom URL
— Select a page —

Editor

PageCustom URL
— Select a page —

Author

PageCustom URL
https://example.com
No more login form after logoutEach role sent to a destination that confirms it worked.
Active
Quick answer

What does Redirect After Logout do?

When the redirect_after_logout module is active, TOWP_Redirect_After_Logout hooks WordPress's own logout_redirect filter to send a user to a specific page or URL based on their role, right after they sign out, instead of WordPress's default return to the login form. WordPress core captures the user's object before the session is actually destroyed, so their roles are still available to the filter at the exact moment logout happens. Since a user holding several roles could have different destinations configured, the module ranks each by how many capabilities it actually grants and picks the most privileged one, working correctly for custom roles too, not just the five built-in ones.

The "logout looks like an error" problem

By default, signing out lands everyone back on the login form

Because the default destination after logout is the login screen, most sites leave every role with the same slightly confusing exit.

The default destination reads like something broke

WordPress sends a logged-out user straight back to the login form, which looks and feels like an error screen rather than a confirmation that logging out actually worked.

It invites signing straight back in, which isn't always the point

A login form sitting right there after logout nudges people to re-enter their credentials immediately, even when leaving the account was the whole intention.

A dedicated WordPress solution

A destination that actually confirms the logout, per role

The module replaces the default login-form return with a choice per role, resolved correctly even when someone holds more than one.

A page or URL, chosen per role

Send each role to a specific page on the site or a custom URL, matching where they should actually land after signing out.

Multi-role users resolved automatically

When a user holds several roles with different destinations, the one granting the most capabilities wins, computed dynamically rather than looked up from a fixed list.

Works for custom roles too

Since priority is based on actual capability count rather than a hardcoded hierarchy, a custom role created through Role Manager gets ranked correctly alongside the built-in five.

Verified feature set

The same reliable algorithm, for the exit instead of the entry

Every capability below is present in the supplied PHP class and its settings registration.

The user is captured before the session ends

Roles stay available at the right moment

WordPress core passes the WP_User object to this filter before the session is actually destroyed, so the module can still read their roles to decide a destination.

Captured pre-destructionRoles still readable
Per-role destination, Page or URL

Two ways to point a role somewhere

Each role can be sent to a page selected from the site, or to any custom URL, matching the segmented control on the settings screen.

Page or Custom URLIndependently configured per role
Dynamic capability-based priority

No hardcoded role hierarchy

The most privileged role among several is determined by counting how many capabilities it actually grants, with ties broken alphabetically for a consistent result.

Capability count rankingDeterministic tie-breaking
Published-page validation

A deleted or unpublished page is skipped, not broken

Before using a configured page, the module confirms it's still a published page; if not, that role's destination is silently skipped rather than pointing somewhere broken.

get_post_status checkNo dead-link redirects
External URLs actually work

The same wp_safe_redirect() fix as the login version

Since wp-login.php's own redirect function blocks external hosts by default, the module explicitly whitelists the host of every configured Custom URL.

allowed_redirect_hostsPrevents silent fallback
Practical use cases

Where a real logout destination helps most

The module supports any site where a login form isn't the right thing to see right after signing out.

Membership sites and shops sending customers home

Return a signed-out customer to the site itself, rather than a login form that reads as an unexpected error.

A dedicated "you've been signed out" confirmation page

Give any role a page that actually confirms the logout, instead of leaving them staring at a login prompt.

Client sites with several distinct staff roles

Give each role, editorial, support, or otherwise, a logout destination that matches how they actually use the site.

Operational benefits

An exit that confirms itself, for every role

The module combines a real UX improvement with the same resolution algorithm that already holds up for multi-role and custom roles.

A logout that doesn't look like a mistakeA dedicated destination replaces a bare login form, so leaving the account reads as intentional rather than broken.
Multi-role users still get exactly one, correct destinationInstead of an arbitrary or blank result, a user with several roles ends up wherever the most privileged of them is configured to go.
External destinations work reliablyThe host-whitelisting fix means a Custom URL destination actually redirects there, instead of silently falling back to the default.
No broken redirects from a deleted pageA page that's been unpublished or removed gets skipped automatically, rather than sending someone to a 404.
Performance behaviour

One check, exactly once per logout

The verified implementation adds no ongoing cost outside the moment of signing out.

One filter check per logout

The redirect decision runs once, at the moment of signing out, adding no ongoing overhead anywhere else.

No effect on roles with nothing configured

A role with no destination set simply falls through to WordPress's own default logout behavior.

A lightweight capability count, not a database-heavy lookup

Ranking roles by privilege reads each role's already-loaded capability list; it doesn't add any extra queries.

Security implementation

Navigation only, validated before use

The code changes where a role lands, never what that role was able to do while signed in.

01

A navigation setting, not an access control

This module only changes where a role lands after signing out; it has no effect on what that role could do while logged in.

02

External redirects are explicitly whitelisted, not opened broadly

Only the hosts of destinations actually configured in the settings get added to the allowed list, not an open pass for any external URL.

03

A page destination is validated before use

The module confirms a configured page is genuinely published before redirecting there, avoiding a dead link from an outdated setting.

04

Configuration requires the same access as any other setting

Setting a role's destination happens through the standard TheOneWP settings screen, available only to an administrator.

Verified compatibility

Built directly around WordPress's own logout redirect system

The supplied code integrates through APIs present in WordPress core; this page makes no compatibility claim beyond the verified implementation.

Post-logout redirect

logout_redirect filter

The native WordPress filter that determines where a user goes immediately after signing out.

logout_redirectNative WordPress filter
External redirect safety

allowed_redirect_hosts filter

The native WordPress filter used to permit wp_safe_redirect() to send someone to an external host when explicitly configured.

allowed_redirect_hostsNative filter
A separate system from Redirect Manager

Not the same as TOWP_Redirect_Manager

This module handles post-logout navigation specifically; general front-end URL redirects are handled by a separate, unrelated system.

Distinct from Redirect ManagerLogout-specific scope
Solution comparison

TheOneWP versus common alternatives

Compare the verified Redirect After Logout implementation with a typical hardcoded-hierarchy approach.

CapabilityTheOneWP Redirect After LogoutOther common solutions
Multi-role resolution Ranked dynamically by actual capability countOften a hardcoded hierarchy limited to the five built-in roles
Custom role support Works correctly without any extra configurationCustom roles frequently fall through to a default or unranked behavior
External URL destinations Host explicitly whitelisted, so it actually redirects thereA common oversight leaves external redirects silently failing
Broken page destinations Validated as published before use, skipped if notSome approaches redirect to a 404 without checking
Default WordPress behavior Replaced with a role-specific destinationLeaves every role staring at the login form after signing out
Recommended workflow

Set a real logout destination in four steps

Test with a multi-role account before considering the setup finished.

01

Enable Redirect After Logout

Activate the module from the TheOneWP Login settings tab.

02

Choose Page or Custom URL for each role that needs one

Configure a destination for roles where the login form isn't the right thing to see after signing out.

03

Select a page or enter a URL

Pick a published page from the site, or type in any custom address for that role.

04

Log out as each configured role to confirm

Sign in and out as a test account for each role and confirm the redirect lands where expected.

Best practices

Pair entry and exit for a coherent session

The logout destination is most effective configured alongside its counterpart for signing in.

01

Pair this with Redirect After Login for a complete flow

The two modules cover opposite ends of the same session; configuring both gives every role a coherent entry and exit.

02

Point customers back to the site, not a bare confirmation page

For a public-facing role, the homepage or a relevant landing page usually reads better than an empty logout notice.

03

Keep multi-role priority in mind when testing

If a test account holds several roles, confirm the redirect matches the most privileged one, not just the role you expect.

04

Point to a stable page, not one likely to be unpublished

Since an unpublished page gets silently skipped, a role's destination should be a page that's meant to stay live.

Common mistakes

Avoid a couple of assumptions about how priority works

A few behaviors are worth understanding correctly the first time through.

Leaving staff roles on the default login-form return

Administrator and Editor may actually want to land back on the login form to sign in again quickly; configuring a destination for them isn't always necessary.

Expecting the lowest-privilege role to win for a multi-role user

The most privileged role, not the first one configured or the lowest-privilege one, decides the destination when a user holds several roles.

Forgetting Custom URL needs the destination whitelisted automatically

The module handles whitelisting the host on its own; manually adding it elsewhere isn't necessary and won't be required for the redirect to work.

Frequently asked questions

Redirect After Logout FAQ

These answers come directly from the verified class and its settings registration.

What does Redirect After Logout do?

It sends each user to a specific page or URL, chosen per role, right after they sign out, instead of WordPress's default return to the login form.

What happens if a user holds more than one role?

The role granting the most capabilities is used to decide the destination, computed dynamically rather than from a fixed list.

Does this work with custom roles, not just the built-in five?

Yes. Priority is based on how many capabilities a role actually grants, so a custom role gets ranked correctly alongside the default ones.

Why does WordPress's default logout behavior feel like an error?

By default, a signed-out user lands back on the login form, which looks like something went wrong rather than confirming the logout worked.

Can a role be redirected to an external URL, not just a page on the site?

Yes. The module explicitly whitelists the host of any configured Custom URL so the redirect actually works.

What happens if the configured page gets deleted or unpublished?

That role's destination is silently skipped, since the module confirms a page is still published before using it.

Is this the same as the Redirect Manager module?

No. This module handles post-logout navigation specifically; Redirect Manager is a separate, unrelated front-end redirect system.

What happens to a role with no destination configured?

Nothing changes; that role falls through to WordPress's own default logout redirect behavior.

Is this related to Redirect After Login?

They're separate modules covering opposite ends of a session; Redirect After Login handles sign-in, this one handles sign-out.

Who can configure a role's redirect destination?

Only an administrator with access to the TheOneWP settings screen.

Stop leaving every role staring at a login form.Confirm the logout, per role, properly.

Use Redirect After Logout to send each role to its own page or URL after signing out, with multi-role users resolved correctly, even for custom roles.