6

It looks like there is not an easy way to add autocomplete="off" to the password input on the WordPress login page without editing the wp-login.php page directly.

Is there something I'm missing? I do not want to modify core files.

1
  • 3
    This is a PCI compliance issue. No website can pass a PCI compliance scan if the password fields allow autocomplete. Dec 15, 2015 at 18:40

6 Answers 6

6

Your only solution (without modifying core files) is to use JavaScript.

function wpse_159462_login_form() {
    echo <<<html
<script>
    document.getElementById( "user_pass" ).autocomplete = "off";
</script>
html;
}

add_action( 'login_form', 'wpse_159462_login_form' );

Having said that, if you're not the only one that will be signing in I would advise against disabling autocomplete, it will almost certainly **** people off.

1
3

If anyone cares this is a solution that worked for me

if ( $GLOBALS['pagenow'] === 'wp-login.php' ) {
  ob_start();
}

add_action('login_form', function($args) {
  $login = ob_get_contents();
  ob_clean();
  $login = str_replace('id="user_pass"', 'id="user_pass" autocomplete="off"', $login);
  $login = str_replace('id="user_login"', 'id="user_login" autocomplete="off"', $login);
  echo $login; 
}, 9999);
1
  • You can put the ob_start() into the "login_form_login action instead of the if Sep 1, 2023 at 0:45
2

Here is a solution with PHP only I come up with:

function disable_autofill_password($safe_text, $text) {
    if($safe_text === 'user_pass') {
        $safe_text .= '" autocomplete="new-password';
    }
    return $safe_text;
}
add_filter('attribute_escape', 'disable_autofill_password', 10, 2);

It's a little hack of the esc_attr filter, it close the id attribute of the password input then add the autocomplete attribute (the new-password value is used for Chrome).

0

someone has made a plugin to do just that, it's not on WordPress plugins but it's pretty simple and works a treat. Good practice to have a look at the source if you're unsure about plugins not listed on wp plugins, I did and there's nothing nasty in it.

see the code here: https://www.buzelac.com/2014/10/disabling-wordpress-login-password-autocomplete/

or download the plugin here: https://www.buzelac.com/wp-content/uploads/2015/05/disable-login-autocomplete.zip

there's not a lot to it, it simply replaces the 'id="user_pass"' with 'id="user_pass" autocomplete="off"' when the login form is generated:

$content = str_replace('id="user_pass"', 'id="user_pass" autocomplete="off"', $content);

0

Try PHP Output Buffering:

add_action('login_header', function () {
    ob_start();
});

add_action('login_footer', function () {
    $content = ob_get_clean();
    $content = str_replace(' name="log"', ' name="log" autocomplete="off"', $content);
    $content = str_replace(' name="pwd"', ' name="pwd" autocomplete="off"', $content);
    echo $content;
});
-4

Open your wp-login.php & add autocomplete="off" in "Username" field. Find form named loginform & add as:

class="input" value="" size="20" autocomplete="off"/>

1
  • 1
    He said that he don't want to modify the core files. Also you should never ever modify the core fields.
    – Laxmana
    Mar 8, 2017 at 12:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.