How do I force password reset even with wrong password entered?

Question

I am currently moving from a custom platform to WordPress.

I don't believe there is anyway to migrate passwords from our current site due to encryption.

User will be emailed to reset their password once we launch the new site, but from past data, I know a majority of users will ignore this email.

My thought was to trigger the password reset automatically when the user tries to login. I was going to use the "Expire Passwords" plugin, but it seems that you need to enter your correct password for the reset password action to trigger.

Any suggestions on how to solve this problem? Thank you for your time and help. Cheers

Answer 1

I don't believe there is anyway to migrate passwords from our current site due to encryption.

I wouldn't necessarily rule that out. While WP uses PHPass as its regular hash for passwords, it still supports MD5 which was the original hash.

If a password is an MD5 hash, it will be updated to the new hash when the user logs in.

If your existing site's passwords are MD5 hashed, or if they can be converted to MD5, then you may be able to migrate your passwords.

Answer 2

If your current platform is on PHP and uses password_hash() to create hashed passwords then you can use a plugin like password-bcrypt or PHP Native Password Hash. Personally I'd recommend the latter as the plugin also supports Argon2 which is stronger than bcrypt. If you instead use crypt() to create bcrypt hashed passwords then it likely already works with WordPress without further effort on your part. In either case you could simply copy over all the hashed passwords for your users into your WordPress database and everyone should be able to log in with their existing passwords.

Now if you still want to force a password reset you could always do so by setting new, random passwords for all your users with a script. They won't be able to log in and they will be forced to go through the reset process. In PHP 7+ for each user you could do something like:

$db = new mysqli('dbhost', 'dbuser', 'dbpass', 'dbname');
// Get array $userList with all usernames from DB or somewhere else
foreach ( $userList as $user ) {
    $hashed = password_hash( random_bytes(16) );
    $db->query( 'update wp_users set user_pass='.$hashed.' where user_login='.$user);
}
$db->close();

The default in PHP for password_hash() is to create a bcrypt hash and since the idea is to force a reset anyways I wouldn't bother trying to use a stronger algorithm. You would also be using random_bytes which is designed to create cryptographically secure random data.