Gravity Forms Login and User Registration: Setup Guide

Gravity Forms can create a front-end WordPress login form through its User Registration Add-On. The fastest method is the official [gravityform action="login"] shortcode. You can also use the add-on’s Login widget, override its theme templates, or add Odd Jar’s User Registration Block when you want to configure the same login form directly in the block editor.

The User Registration Add-On also turns a Gravity Form submission into a WordPress account, maps form fields to user data, assigns a role, supports email activation, and can update an existing user’s profile. This guide covers the login and registration paths as one system so you do not need separate, overlapping pages.

What you need

• An active Gravity Forms installation
• The Gravity Forms User Registration Add-On, currently included with Elite and Nonprofit licenses
• Permission to create and configure WordPress users and roles
• A staging site or reliable backup before changing login and account flows

The add-on creates and updates users, but it does not create custom WordPress roles or restrict content by role. Use a dedicated role/capability or membership tool if those controls are part of the project.

How to add a Gravity Forms login form

Method 1: use the official login shortcode

Add a Shortcode block to the page where users should sign in, then enter:

[gravityform action="login"]

The official Gravity Forms login-shortcode documentation lists parameters for the title, description, logged-in message, avatar, registration link, password-reset link, redirects, tab index, and theme. For example:

[gravityform action="login"
title="false"
description="false"
login_redirect="/account/"
logout_redirect="/"
registration_link_text="Create an account"
forgot_password_text="Reset your password"]

Use site-relative redirect paths when the destination is on the same domain. After publishing, test successful login, failed login, password reset, registration, logout, and the already-logged-in state.

Useful login shortcode parameters

Method 2: use a native WordPress block

User Registration Block for Gravity Forms is an Odd Jar plugin that exposes the add-on’s login form and supported options as a Gutenberg block. It is useful when an editor should be able to place and configure the form without maintaining shortcode attributes.

Disclosure: Odd Jar makes this plugin. It uses pay-what-you-want pricing, including $0. It does not replace Gravity Forms or the User Registration Add-On; those still provide the login and account functionality.

1. Install and activate the User Registration Block plugin.
2. Edit the login page in the block editor.
3. Open the block inserter and find the User Registration block.
4. Add the block and configure its login, link, message, avatar, and redirect options.
5. Publish and test the same logged-out and logged-in states as the shortcode method.

Method 3: use the Login widget

The User Registration Add-On includes a Login widget. On a block theme, add it through the widget or legacy-widget block where supported. This can work for a sidebar or footer, but a dedicated login page is usually easier to link, test, and style consistently.

Method 4: override the login templates

Developers can place gravityformsuserregistration-login.php and gravityformsuserregistration-loggedin.php in the top level of the active theme. Gravity Forms will use those files instead of the default login markup.

Use a child theme or a custom plugin-based approach so a theme update does not erase the work. Gravity Forms publishes a login-template customization reference with example templates. A blank override produces a blank result, so preserve the required fields, links, nonce handling, and accessibility behavior.

How to create a Gravity Forms user-registration form

1. Build the form

Create a new form or use the User Registration template. The add-on requires fields that can supply a username and email address. A typical form includes:

• Username
• Email
• Name
• Password, or an email-based password setup flow
• Any profile fields the site actually needs
• Consent fields when required by the site’s privacy process

Collect the minimum data necessary for the account. Every additional field creates another abandonment point and another piece of personal data to protect.

2. Create a User Registration feed

Open the form and go to Settings → User Registration. Add a new feed and choose Create User. Map the form fields to the corresponding WordPress fields:

• Username
• Email address
• First and last name
• Display name
• Password
• User role
• Custom user metadata when needed

The feed is the rule set that turns a valid form submission into a WordPress user. The official add-on guide covers required fields, feed creation, custom registration pages, role limitations, payment integration, and BuddyPress mapping.

3. Choose account activation behavior

Email activation adds proof that the registrant controls the address they entered. When activation is enabled, the account remains pending until the activation link is used. Customize the activation and welcome notifications so users understand what happens next.

Test the message in more than one email client. Confirm the link points to the production domain, the activation page works while logged out, and expired or reused links fail gracefully.

4. Assign the least-privileged role

Use Subscriber or a purpose-built low-privilege role unless the workflow genuinely requires more. Never let a public registration form assign Administrator, Editor, or another role with publishing, plugin, theme, user, or settings capabilities.

5. Set a custom registration page

Publish the form on a WordPress page, then go to Forms → Settings → User Registration. Enable the custom registration page and select that page. The add-on can then redirect the standard WordPress registration URL to the front-end form.

How to redirect users after login

For one shared destination, use the shortcode or block’s login_redirect option. A Gravity Forms confirmation belongs to a submitted Gravity Form; it is not the setting that controls the User Registration Add-On’s separate login form.

For role-based or conditional destinations, use the documented gform_user_registration_login_redirect_url filter in a small custom plugin. Avoid placing critical site behavior in a parent theme’s functions.php, where a theme update or replacement can remove it.

How to let users edit their profiles

Create a separate form and a User Registration feed configured to Update User. Restrict the form to authenticated users under Form Settings → Restrictions → Require user to be logged in. Gravity Forms documents this setting as hiding the form from logged-out visitors and displaying a custom login-required message instead.

Pre-populate each editable field from the current user’s data, map the submitted values back to the user account, and decide which fields users may change. Treat email-address and password changes more carefully than ordinary profile fields because they affect account access and recovery.

Security and abuse controls

• Enable two-factor authentication for administrators and other privileged roles.
• Use a strong-password requirement and a safe password-reset flow.
• Add Gravity Forms anti-spam controls or a compatible challenge such as Turnstile where abuse warrants it.
• Rate-limit repeated login attempts at the host, firewall, or security-plugin layer.
• Do not expose sensitive user metadata in confirmations, notifications, or front-end profile pages.
• Keep Gravity Forms and the User Registration Add-On updated.
• Review abandoned, pending, duplicate, and suspicious registrations.
• Protect file-upload fields with strict type, size, storage, and access rules.

For upload workflows, see the Gravity Forms file-upload security guide. For site-wide account protection, the WordPress security-plugin comparison explains endpoint and cloud firewall options.

Pre-launch test checklist

1. Register a new user with valid data.
2. Attempt a duplicate username and duplicate email address.
3. Complete and fail the activation flow.
4. Log in with the username and with the email address if both are supported by the configuration.
5. Test an invalid password and password reset.
6. Confirm login and logout redirects.
7. Verify that logged-in users see the correct message or account destination.
8. Update every permitted profile field.
9. Confirm that a user cannot assign or escalate their own role.
10. Test the entire flow on mobile and with keyboard navigation.
11. Confirm notifications reach the user and site owner without exposing passwords.
12. Verify caching does not serve one user’s account state to another visitor.

Frequently asked questions

Does Gravity Forms have a login form?

Yes. The User Registration Add-On supplies a front-end login form through the [gravityform action="login"] shortcode and the Login widget. Odd Jar’s optional block provides a Gutenberg interface for the same add-on functionality.

Can Gravity Forms register WordPress users?

Yes. Create a form with username and email fields, then add a User Registration feed configured to create a user and map the form fields to WordPress account data.

Can users edit their WordPress profiles with Gravity Forms?

Yes. Use a second form with an Update User feed, pre-populate it with the current user’s values, and restrict access to logged-in users.

Can Gravity Forms create custom roles or restrict content?

No. The User Registration Add-On can assign an existing role, but Gravity Forms states that it does not create roles and capabilities or provide content restriction. Use a dedicated role or membership tool for those jobs.

Which Gravity Forms license includes User Registration?

Gravity Forms currently lists the User Registration Add-On with Elite and Nonprofit licenses. Check the official feature page before purchase because packaging can change.