6

It looks like there is not an easy way to add autocomplete="off" to the password input on the WordPress login page without editing the wp-login.php page directly.

Is there something I'm missing? I do not want to modify core files.

Improve this question
1
  • 3
    This is a PCI compliance issue. No website can pass a PCI compliance scan if the password fields allow autocomplete.
    – Christopher Eller
    Commented Dec 15, 2015 at 18:40

6 Answers 6

Reset to default
6

Your only solution (without modifying core files) is to use JavaScript.

function wpse_159462_login_form() {
    echo <<<html
<script>
    document.getElementById( "user_pass" ).autocomplete = "off";
</script>
html;
}

add_action( 'login_form', 'wpse_159462_login_form' );

Having said that, if you're not the only one that will be signing in I would advise against disabling autocomplete, it will almost certainly **** people off.

Improve this answer
1
3

If anyone cares this is a solution that worked for me

if ( $GLOBALS['pagenow'] === 'wp-login.php' ) {
  ob_start();
}

add_action('login_form', function($args) {
  $login = ob_get_contents();
  ob_clean();
  $login = str_replace('id="user_pass"', 'id="user_pass" autocomplete="off"', $login);
  $login = str_replace('id="user_login"', 'id="user_login" autocomplete="off"', $login);
  echo $login; 
}, 9999);
Improve this answer
1
  • You can put the ob_start() into the "login_form_login action instead of the if
    – Peter Ajtai
    Commented Sep 1, 2023 at 0:45
2

Here is a solution with PHP only I come up with:

function disable_autofill_password($safe_text, $text) {
    if($safe_text === 'user_pass') {
        $safe_text .= '" autocomplete="new-password';
    }
    return $safe_text;
}
add_filter('attribute_escape', 'disable_autofill_password', 10, 2);

It's a little hack of the esc_attr filter, it close the id attribute of the password input then add the autocomplete attribute (the new-password value is used for Chrome).

Improve this answer
0

someone has made a plugin to do just that, it's not on WordPress plugins but it's pretty simple and works a treat. Good practice to have a look at the source if you're unsure about plugins not listed on wp plugins, I did and there's nothing nasty in it.

see the code here: https://www.buzelac.com/2014/10/disabling-wordpress-login-password-autocomplete/

or download the plugin here: https://www.buzelac.com/wp-content/uploads/2015/05/disable-login-autocomplete.zip

there's not a lot to it, it simply replaces the 'id="user_pass"' with 'id="user_pass" autocomplete="off"' when the login form is generated:

$content = str_replace('id="user_pass"', 'id="user_pass" autocomplete="off"', $content);

Improve this answer
0

Try PHP Output Buffering:

add_action('login_header', function () {
    ob_start();
});

add_action('login_footer', function () {
    $content = ob_get_clean();
    $content = str_replace(' name="log"', ' name="log" autocomplete="off"', $content);
    $content = str_replace(' name="pwd"', ' name="pwd" autocomplete="off"', $content);
    echo $content;
});
Improve this answer
-4

Open your wp-login.php & add autocomplete="off" in "Username" field. Find form named loginform & add as:

class="input" value="" size="20" autocomplete="off"/>

Improve this answer
1
  • 1
    He said that he don't want to modify the core files. Also you should never ever modify the core fields.
    – Laxmana
    Commented Mar 8, 2017 at 12:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.