I just tried to login to an old WordPress site of mine. I forgot that I already sold the website. I tried logging in, using my login credentials, but obviously I wasn't able to login. Now my question is, does WordPress or any plugin notify the website owner about this attempt and, more importantly, reveal the password that has been used?


  • 1
    This would be a real security flaw. I don't think this is (easily) possible at all. Unfortunately you are asking for plugins, which is off-topic. And the rest you simply can test yourself with other of your own instances of WordPress. In short: No WP never reveals login credentials. – leymannx Jun 5 at 8:41
  • 1
    @leymannx on the contrary - it's pretty easy to log the password that was used in login form - and that's what OP is asking, I guess... – Krzysiek Dróżdż Jun 5 at 8:54
  • 2
    @KrzysiekDróżdż – True that. But at least not by WP itself or any known plugin. – leymannx Jun 5 at 8:59
  • @RobbTe If you are concerned because you've reused this password elsewhere, then I'd recommend getting a password manager and not reusing passwords anymore. :-) – J.D. Jun 5 at 18:13

There are few scenarios you have to consider.

1. Obtaining your password from database

This is almost impossible to do. WordPress stores all passwords as hashes.

When you log in, the password you've entered in form is hashed and compared with the hash stored in DB.

This way you can check if the password is correct, but you can't obtain the password from database.

And because these hashes are salted and not plain MD5, you even can't easily guess common passwords.

So you're completely safe from this point of view.

2. Logging passwords filled in the login form

This is completely different from 1. When you go to the login form and fill in the password, then you fill it as plain text. It is then sent to the server (again as plain text).

So, if owner of the site wants to, he can add some code* that will log/store that password during the process of logging in.

Of course it's not recommended, because this way you will compromise passwords of your users.

*All you need to do is to use wp_authenticate hook - it gets login and password as arguments (as you can see here), so you can do whatever you want with them.

  • 2
    To add to your 2nd point: It could be that a security plugin (wordfence, sucuri, ..) notifies the owner of the failed login. In my opinion this scenario is more likely than some custom plugin code to steal (failed) login passwords. – kero Jun 5 at 9:08
  • Exactly, but do these plugins reveal the used password as well? – RobbTe Jun 5 at 10:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.