WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I own an article directory website and recently a lot of bots have signed up and started posting spam. (I approve posts prior to publication)

I've added a captcha to the user registration page now but for the users that are already registered I want to make their passwords expire so they have to set new ones and obviously the bots won't be able to do this.

I've tried multiple plugins with no success. I don't really know what to do. I have over 1800 users so going through them 1 by 1 is not an option.

Would appreciate this a lot!

Thank you!

share|improve this question

Some underlying functionality borrowed from http://wordpress.org/extend/plugins/auto-expire-passwords/ , and tweaked. Untested, but along the lines of what you are looking for, so YMMV.

function custom_forced_password_reset( $user ) {
    update_user_meta( $user->ID, 'password_was_force_reset', true );
add_action( 'password_reset', 'custom_forced_password_reset' );    

// Ensure all new register users have the flag set
function custom_forced_password_user_register($user_id){
    update_user_meta( $user_id, 'password_was_force_reset', true );
add_action( 'user_register', 'custom_forced_password_user_register', 10, 1 );

function custom_log_in_check( $user, $username, $password ) {
    if ( is_wp_error( $user ) )
        return $user;

    // Check we're dealing with a WP_User object
    if ( ! is_a( $user, 'WP_User' ) )
        return $user;

    // This is a log in which would normally be succesful
    $user_id = $user->data->ID;

    $reset = get_user_meta( $user_id, 'password_was_force_reset', false );
    if ( empty( $reset ) || $reset == false ) {
            $user = new WP_Error( 'authentication_failed', sprintf('<strong>ERROR</strong>: You must <a href="%s">reset your password</a>.', site_url( 'wp-login.php?action=lostpassword', 'login' ) ) );

    return $user;
add_filter( 'authenticate', 'custom_log_in_check', 30, 3 );
share|improve this answer
So should I download that plugin and make the changed you made above? Could you guide me on how to do this? – Mohammad G Apr 24 '12 at 21:20
@MohammadG "Some underlying functionality borrowed from(...)" – kaiser Apr 25 '12 at 14:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.