1

Would like to find out if there is any way I could customize the wp_login page to remove the "There is no account with that username or email address." validation (show below)

enter image description here

and any email/username entered are all redirected to this check email page instead?

enter image description here

I understand making change to wp-login.php is not advisable.
Seeking experts here for recommendation and advise.

Thanks in advance!

4
  • if sending a confirmation link is possible then that first screen should be impossible, can you explain the problem that this would solve for you? Doing this would have negative security consequences as it would be possible to list unconfirmed users for exploitation
    – Tom J Nowell
    Nov 15, 2021 at 10:01
  • Hi Tom, my intention of removing this email check validation is to prevent user enumeration attacks. Without this validation in place, there is no longer a "hint" made known to an attacker to guess or confirm if the email entered is a valid account to my WP portal.
    – BBBBB86
    Nov 16, 2021 at 0:47
  • Do you mean that if I disable the validation check, the confirmation link will be sent out regardless the email entered is a valid or a non-existing account in my portal? I think this can be customized on the PHP end to prevent that right?
    – BBBBB86
    Nov 16, 2021 at 1:01
  • I believe I misunderstood
    – Tom J Nowell
    Aug 14, 2023 at 9:14

1 Answer 1

0

On a successful lost password email send, Wordpress forwards to the login page with the query string ?checkemail=confirm. So we can happily just manually redirect to this page when we evaluate that the lostpassword form is being shown after the user made a post request. Then we can update the confirmation text to suit our needs.

add_action( 'lost_password', 'prevent_lost_password_enumeration', 10, 1 );
add_filter( 'gettext', 'change_lost_password_email_sent_notice', 10, 3 );

function prevent_lost_password_enumeration($errors) {

    $http_post = 'POST' === $_SERVER['REQUEST_METHOD'];

    if (!$http_post) return;

    //Allow an empty message to show
    if (empty(trim(strval($_POST['user_login'] ?? '')))) return;

    $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : 'wp-login.php?checkemail=confirm';

    wp_safe_redirect($redirect_to);
    exit;

}

public function change_lost_password_email_sent_notice($translated_text, $text, $domain) {

    $default = 'Check your email for the confirmation link, then visit the <a href="%s">login page</a>.';
    
    if ($default !== $text) return $translated_text;

    $new = 'If your email address exists in our system, we have sent you an email with instructions to reset your password';

    return esc_html($new);
    
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.