diff --git a/README.md b/README.md
index b8c2ba20..915b0e0c 100644
--- a/README.md
+++ b/README.md
@@ -170,7 +170,7 @@ By default, WordPress' task manager runs on every page load, which is inadvisabl
 
 ### Authentication with Universal Login
 
-The plugin hands authentication over to Auth0's Universal Login. Visitors sign in through your Auth0 tenant rather than the default WordPress login form, which lets you layer on Auth0 capabilities such as MFA, SSO, Passwordless, and Passkeys without changing your WordPress site. Authentication is turned on with a single "Enable Authentication" toggle once your Domain, Client ID, and Client Secret are configured.
+The plugin hands authentication over to Auth0's Universal Login. Visitors sign in through your Auth0 tenant rather than the default WordPress login form, which lets you layer on Auth0 capabilities such as MFA, SSO, Passwordless, and Passkeys without changing your WordPress site. Authentication is turned on with a single "Enable Authentication" toggle once your Domain, Client ID, and Client Secret are configured. After a successful login, the plugin respects WordPress's standard `redirect_to` parameter. If a logged-out user visits a protected page, they are returned to that page after authenticating.
 
 ### WordPress user management
 
diff --git a/src/Actions/Authentication.php b/src/Actions/Authentication.php
index bdb265a3..f7db8172 100644
--- a/src/Actions/Authentication.php
+++ b/src/Actions/Authentication.php
@@ -536,7 +536,20 @@ public function onLogin(): void
                     wp_set_current_user($wpUser->ID);
                     wp_set_auth_cookie($wpUser->ID, true);
                     do_action('wp_login', $wpUser->user_login, $wpUser);
-                    wp_redirect('/');
+
+                    $destination = get_site_url();
+
+                    if (null !== $state) {
+                        $transientKey = 'auth0_redirect_' . hash('sha256', $state);
+                        $stored = get_transient($transientKey);
+
+                        if (false !== $stored) {
+                            delete_transient($transientKey);
+                            $destination = (string) $stored;
+                        }
+                    }
+
+                    wp_redirect($destination);
                     exit;
                 }
             }
@@ -548,11 +561,26 @@ public function onLogin(): void
         }
 
         if ($exchangeParameters && null === $error && (0 !== wp_get_current_user()->ID || null !== $this->getSdk()->getCredentials())) {
-            wp_redirect('/');
+            if (null !== $state) {
+                delete_transient('auth0_redirect_' . hash('sha256', $state));
+            }
+            wp_redirect(get_site_url());
             exit;
         }
 
-        wp_redirect($this->getSdk()->login());
+        $loginParams = [];
+
+        if (isset($_REQUEST['redirect_to']) && is_string($_REQUEST['redirect_to'])) {
+            $redirectTo = wp_validate_redirect(esc_url_raw($_REQUEST['redirect_to']), '');
+
+            if ('' !== $redirectTo) {
+                $stateKey = wp_generate_password(32, false);
+                set_transient('auth0_redirect_' . hash('sha256', $stateKey), $redirectTo, 10 * MINUTE_IN_SECONDS);
+                $loginParams['state'] = $stateKey;
+            }
+        }
+
+        wp_redirect($this->getSdk()->login(params: $loginParams));
         exit;
     }