Custom WordPress login modal with AJAX – logging in works but then any attempt to access /wp-admin causes a redirect to ‘SITE_URL/home’

I have created a custom login modal for my wordpress site. In seems to be working on the surface, as in it logs in correctly, the admin bar appears at the top on page refresh and I’m able to access front-end content that is only available to admin accounts when I log in as an admin.

However, when I try to access any page in the dashboard (/wp-admin), the page hangs for a
while and then redirects me to the homepage with ‘/home’ added to the URL.

I built the functions.php action that receives the login data from the front-end and calls wp_signon() as I saw in the documentation. So I’m a bit confused why it is behaving as it is. Am I missing something from the login process?

Here is the action:

function ajax_custom_login() {
    $remember = isset($_POST['remember']) && $_POST['remember'] === 'on';

    $info = array();
    $info['user_login']    = sanitize_text_field($_POST['username']);
    $info['user_password'] = sanitize_text_field($_POST['password']);
    $info['remember']      = $remember;

    $user = wp_signon($info, false);

    if (is_wp_error($user)) {
        wp_send_json_error(array('message' => $user->get_error_message()));
    } else {
        wp_send_json_success(array('message' => 'Login successful, redirecting...'));
    }
}

I am using Wordfence and require administrators to use 2FA (not normal users) so I’m assuming this might be part of the problem. However, I’ve tried logging into the administrator account using the /wp-login.php page and told WordFence to “Remember for 30 days”.

Edit: Potentially ignore the Wordfence part below this – I have just tried the login process with my custom login form, after deactivating Wordfence, and the redirect is still happening. So it doesn’t seem like that is the problem.

If I do this, then log out and then log in with the custom login form, I thought it would let me log in because Wordfence is remembering the login for 30 days. It seems like it might be partially doing this because I’m able to get a success response back from wp_signon() and the admin bar appears on refresh, but I’m wondering if Wordfence is causing the ‘SITE_URL/home’ redirect? Is this a known problem? Am I missing something else in the login process?

Any advice would be greatly appreciated.