0

I have a Wordpress multisite. One of the sites has two users: me and the enduser. There are multiple password reset attempts for the enduser, not initiated by him.

I block the IP in the firewall of the hosting server, but the attempts keep coming from different IP's.

Every time this happens the endusers gets en e-mail, and he's concerned about security.

So, I want to completely disable password recovery. Googling this returns a lot of howto's, but for some reason, none of them work on my system.

What I tried:

  • Installing (and activating network-wide) the plugin Disable Password Reset by H3llas. Result: nothing changed. Password reset still works.

  • Installing Plainview Protect Passwords, blocking password reset for all users. Result: nothing changed. Password reset still works.

  • Editing functions.php of the child-theme of the site of the end user with below code:

    function disable_password_reset() { 
                  return false;
                  }
    add_filter ( 'allow_password_reset', 'disable_password_reset' );
    
    function remove_lostpassword_text ( $text ) {
         if ($text == 'Lost your password?'){$text = '';} 
            return $text; 
         }
    add_filter( 'gettext', 'remove_lostpassword_text' ); 
    

    Result: nothing changed. Password reset still works.

  • Editing functions.php with above code for the child-theme of the main site. Result: nothing changed. Password reset still works.

After each step I cleared the cache of WP Super Cache and my browser.

Any idea why non of these seem to work on my site?

0
2
+50

Since this is a multisite you'll have to put the disable password filter in a mu-plugin. Create a file in wp-content/mu-plugins with:

<?php

add_filter( 'allow_password_reset', '__return_false' );

That should completely disable password recovery. It will affect all sites, not just that one customer's: if that's not what you intended you'll have to add logic here to restrict it to that one user e.g. by name, or by checking for permissions / roles on that customer's site, or by a flag in user meta.

2
  • 1
    I'm a bit hazy on the details but I guess the login page (and hence password reset mechanism) doesn't run in the context of any one blog, and so won't load any theme or plugins either, I presume if your network-wide disable password reset plugin didn't work. But it will load mu-plugins. – Rup Oct 8 '20 at 8:47
  • That worked! I didn't know about mu-plugins. I added the below code, to also hide the link on the login page. add_filter ( 'allow_password_reset', 'disable_password_reset_mu' ); function remove_lostpassword_text_mu( $translated_text, $untranslated_text, $domain ) { if ($untranslated_text == 'Lost your password?') { return ''; } return $translated_text; } add_filter( 'gettext', 'remove_lostpassword_text_mu', 999, 3 ); – Coder14 Oct 8 '20 at 9:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.