I am looking at this generate password function:

function wp_generate_password( $length = 12, $special_chars = true, $extra_special_chars = false ) {
    $chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
    if ( $special_chars )
        $chars .= '!@#$%^&*()';
    if ( $extra_special_chars )
        $chars .= '-_ []{}<>~`+=,.;:/?|';

    $password = '';
    for ( $i = 0; $i < $length; $i++ ) {
        $password .= substr($chars, wp_rand(0, strlen($chars) - 1), 1);

    // random_password filter was previously in random_password function which was deprecated
    return apply_filters('random_password', $password);

What I am trying to understand is the apply_filters part. Am I correct what it does is return random_password($password)? Where random_password is the filter function? But I cannot find random_password defined in any of the source files?

Am I right in thinking if the source code can't find random_password() it returns $password, and if it can find random_password() defined somewhere it returns random_password($password)? If so, where in the source code do I define random_password()?



To fully understand how WP works, you need to understand that WP is an event-driven platform(Though it's a loose term, but I think it does help to understand better). You need to think like which event is occurring right now.

In this case, a password is generated.

Next question is, How can you change this generated your desired way. WP has provided a filter hook named random_password with apply_filters and also have provided the generated password for you to change( There's also action hook. See Difference Between Filter and Action Hooks?).

You define the function to use to change the password with add_filter.

I ask you first to read the documentation of

Let's go back to your example. I also invite you to read the documentation of

codex says

It generates a random password drawn from the defined set of characters.

Now say, you want to create a plugin which will change the way the password is generated.

You can't(won't any way want to) change the code of the WP core files. But you need to accomplish this. Wordpress has given you the opportunity to change it via filter hook.

apply_filter function creates a filter in this case named random_password. So, now you have the option to change the generated password as the password is also sent as the argument.

So, random_password is not a function, it's a filter by which you can filter WP generated password your desired way.

Now going back to your wish of changing the auto generated password, you use the filter like this:

add_filter('random_password', 'my_generated_password');

In this case, every event of password generation/call of wp_generate_password will also call my_generated_password function that you define and it will pass $password as argument.

For demonstration purpose, let's say you want to add an extra character L to the generated password. In that case, you will define the function like this:

function my_generated_password($password){
    return ($password . 'L');
  • Thanks very much for the detailed answer I understand that. That leaves me with two questions, why does the source code use apply_filter rather than apply_action? Also, where do I define my_generated_password and where in the code do I tell wordpress: add_filter('random_password', 'my_generated_password'); – user1796995 Jan 12 '14 at 19:53
  • @user1796995 It's just naming convention they used. You need to familiarize yourself with that. For creating filter and action hook function names are apply_filters and do_action. To apply the hooks you have to use add_filter and add_action. You can create a plugin or add the code in your theme's functions.php file. You should definitely use the plugin instead of functions.php. You need to learn codex.wordpress.org/Writing_a_Plugin. You should first understand the very basic of WP. You should definitely read the articles linked by toscho thoroughly. – sakibmoon Jan 12 '14 at 20:09
  • Thank you. So they could also have written return do_action('random_password', $password); and I could use add_action('random_password', 'example_function_i_created')? Or is there a special reason why they chose apply_filters over do_action? I understand now these things are like events in javascript, and they exist so we can change or add functionality without modifying the core code. – user1796995 Jan 12 '14 at 20:22
  • @user1796995 Yes. they exist so we can change or add functionality without modifying the core code.. But you shouldn't ask question like why they have chosen a particular name. It's the same way you give a name to your function. To work with WP, you need to be familiarized with them. You can't use return do_action. Check out the proper usage from codex. At first you might get confused, but you can grasp better after a while. Try start writing a plugin which does very simple thing like changing the title or something similar. You will get better idea that way. – sakibmoon Jan 12 '14 at 20:29
  • I am trying to write a simple plugin now. I think I have the basic idea of it. Ok return do_action is wrong, but why not just do_action? Is there a reason why the source code uses return apply_filters in my original example rather than do_action? It seems like either one of those would do the job equally well, is that right or is there a reason I am missing? :) Thanks and that is my last comment! I will accept your answer – user1796995 Jan 12 '14 at 20:35

random_password is just a name for the event, not a function.

You can register a callback (a function or class method) for that name:

add_filter( 'random_password', 'foo' );

Here, foo must be a function you have defined already:

function foo( $password )
    return 'bar';

See also:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.