wp-login.php forces relogin

Yes, that is exactly how it is intended to be.

Hi @wpshushu
If you are experiencing an issue where you are being forced to re-login after accessing the WordPress login page (wp-login.php), you can take a few steps to try and resolve the issue.

1. First, check if there are any plugin conflicts. Deactivate all your plugins, and then try accessing the login page again. If the issue does not occur when all of the plugins are deactivated, reactivate them one by one until you find the plugin that is causing the issue.

2. Next, check if your theme is causing the issue. Switch to a default WordPress theme (such as Twenty Twenty) and see if the issue persists. If the issue goes away when you switch themes, the issue may be with your current theme.

3. You should also check if you have any active WordPress security plugins. Some security plugins may block login attempts if they detect suspicious activity. If you have a security plugin installed, try disabling it and see if the issue is resolved.

If none of these steps help, it is possible that there may be an issue with your WordPress installation or your web server. In this case, you may need to contact your web hosting provider for further assistance.

@threadi impossible to turn off? I mean user has logged in and opens /wp-login.php, is there a way to redirect her back to for example the front page? Thanks.

Add the following to your child theme’s functions.php or via code snippet plugin:

function custom_check_login() {
 if( is_user_logged_in() ) {
  wp_redirect(get_admin_url());
  exit;
 }
}
add_action( 'login_init', 'custom_check_login' );

This will check in the login page if the user is logged in. If yes, he will be redirected to wp-admin without having to log in again.

@threadi Thanks. Any where documenting why wp-login.php was designed to work this way?

I’m not aware that such details are documented anywhere. You can have a look at the source code of the file: https://github.com/WordPress/WordPress/blob/master/wp-login.php
Or ask the developers about it: https://core.trac.www.ads-software.com/newticket

@threadi Thanks.