WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Wordpress 3.2.1 - The reset password URL in the email generated by http://mysite.com/wp-login.php?action=lostpassword does not contain a valid key and so users are unable to reset their password.

We do have Register Plus Redux plugin installed but the problem persists even if I disable it. Is this a known issue?

Clicking the link gives the error "Sorry, that key does not appear to be valid." The link looks like this:

http://mysite.com/wp-login.php?action=rp&key=&login=email%40mysite.com (they key is empty)

share|improve this question
What do you see if you echo wp_generate_password(20, false); ? (this is how that key is generated) – onetrickpony Sep 28 '11 at 11:06
Was the key generated with that plugin still on? Because it could be that that plugin screwed it up, in which case they'd have to generate a new key... – Joost de Valk Sep 28 '11 at 11:25

The site's original developer was using the reset_password_message filter and had either done it incorrectly or the core code has changed. The following function now works:

function reset_password_message( $message, $key ) {

    if ( strpos($_POST['user_login'], '@') ) {
        $user_data = get_user_by('email', trim($_POST['user_login']));
    } else {
        $login = trim($_POST['user_login']);
        $user_data = get_user_by('login', $login);

    $user_login = $user_data->user_login;

    $msg = __('The password for the following account has been requested to be reset:'). "\r\n\r\n";
    $msg .= network_site_url() . "\r\n\r\n";
    $msg .= sprintf(__('Username: %s'), $user_login) . "\r\n\r\n";
    $msg .= __('If this message was sent in error, please ignore this email.') . "\r\n\r\n";
    $msg .= __('To reset your password, visit the following address:');
    $msg .= '<' . network_site_url("wp-login.php?action=rp&key=$key&login=" . rawurlencode($user_login), 'login') . ">\r\n";

    return $msg;


add_filter('retrieve_password_message', reset_password_message, null, 2);
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.