Clients, members and editors see a site's login page more often than almost any other page, and on most WordPress sites it is the one page nobody designed. The grey box and WordPress logo work, but they break the experience the rest of the site has carefully built, and on a members site they can look like a different website entirely.
I treat the sign-in page as a normal page of the site now. These are the things I check when designing one, whatever tool builds it.
Make it look like the rest of the site
The page should keep the site's header, navigation, typography and footer. A sign-in form that suddenly loses the brand makes people hesitate, and hesitation on a login page is exactly what phishing relies on. Familiar surroundings tell people they are in the right place.
Give the form a short, human introduction too. On a members site that might be a line about what signing in unlocks; on a client site it might be who to contact if they are stuck.
Labels above fields, not just placeholders
Placeholder text disappears as soon as someone starts typing, which leaves people guessing which box they were filling in, especially with autofill. Keep a visible label above each field, make the inputs comfortably tall for touch and let the sign-in button run the full width of the card on small screens.
Write errors people can act on
Put the error message beside the button, where people are already looking, and say what to do next. There is one firm exception: do not reveal whether a username exists. "Unable to sign in with those details" is honest without helping anyone guess accounts. The same goes for lockouts after repeated failures; one wording for every kind of lock, with the time it lifts.
Keep WordPress in charge of the hard parts
A designed sign-in page should change what people see, not how WordPress authenticates them. Password resets, logout, reauthentication and the small sign-in window that appears when a session expires in the editor should all keep using WordPress's own screens. If a custom page tries to replace those, something eventually breaks in a way nobody notices until a client is locked out.
Offer something better than a password
Passkeys let people sign in with Touch ID, Windows Hello, their phone or a hardware key, and they cannot be phished or reused from another site's leak. Offer them alongside two-factor codes and backup codes, and make the profile screen explain clearly which devices work.
Check it on a phone
Most people who forget a password find out on their phone. Check the page at narrow widths: two-column layouts should stack, padding should shrink so the fields keep their width, and the keyboard should not hide the button.
How I build these now
I wrote Ace Login Block for exactly this, and it is free on WordPress.org. You design the sign-in page in the block editor like any other page, drop in the Login block, and choose that page in the settings. Visitors to wp-login.php are sent to your page, while WordPress still processes every sign-in and keeps its reset and recovery screens.
It also handles passkeys, email and authenticator codes, backup codes, per-role rules and redirects, and as of version 0.431.0 a lockout after repeated failures with a readable log of attempts.
The quickest way to judge it is to open the live demo, a small members site running in your browser with nothing to install. If you would like a sign-in experience designed for your own site, get in touch.