30

This does the trick: wp user update USERNAME --user_pass="PASSWORD" (Found it here.)


20

Previous answer didn't worked for me (says that code is invalid, on wp login page), probably because answer is 1,5 yr old, and something is changed in WP code, so I have updated this code a bit (also from wp-login.php), here it is: function retrieve_password($user_login){ global $wpdb, $wp_hasher; $user_login = sanitize_text_field($user_login); ...


15

You cannot export passwords as plaintext in WordPress, because they are not stored in plaintext. What you see here is obviously the result of a very bad plugin. Fields like Payment, Sex or Company are not even part of the regular WordPress tables. For the future: Do not install plugins without prior tests and reviews in a safe environment. Use a local ...


14

When you select password protected option in page back-end, It by-default works for content only. i.e. the_content() But if you want to password protect whole page or have a custom template, you need to have the following structure. <?php global $post; get_header(); if ( ! post_password_required( $post ) ) { // Your custom code should here }else{ ...


14

first check the user name: wp user list then change password without leaving traces in history wp user update admin --prompt=user_pass


13

the solution is simple, there is a filter to change the lost password url. Try this : add_filter( 'lostpassword_url', 'wdm_lostpassword_url', 10, 0 ); function wdm_lostpassword_url() { return site_url('/signin?action=lostpassword'); }


11

Its Not has hard as you think it is :) Add the password fields to your form : password: <input type="password" name="pass1" style="width:250px; margin-bottom:3px;"><br /> repeat password: <input type="password" name="pass2" style="width:250px; margin-bottom:3px;"><br /> then in your if($_POST){ replace this line: $random_password ...


11

The latest entered password is stored as a secure hash in a cookie named 'wp-postpass_' . COOKIEHASH. When the password form is called, that cookie has been validated already by WordPress. So you just have to check if that cookie exists: If it does and the password form is displayed, the password was wrong. add_filter( 'the_password_form', '...


11

Just figured it out. So thought to leave the solution here, if someone else need it: To change the default hashing system, need to overwrite wp_hash_password() function: (can be done in a plugin) if ( !function_exists('wp_hash_password') ){ function wp_hash_password($password) { //apply your own hashing structure here return ...


11

The password strength meter in the latest versions of WordPress uses a library called "zxcvbn", made by Dropbox in 2012. The library is available for free on Github: https://github.com/dropbox/zxcvbn An explanation of the library is here: https://blogs.dropbox.com/tech/2012/04/zxcvbn-realistic-password-strength-estimation/ But the short version is that it ...


11

This will do it :-) add_action( 'wp_print_scripts', 'DisableStrongPW', 100 ); function DisableStrongPW() { if ( wp_script_is( 'wc-password-strength-meter', 'enqueued' ) ) { wp_dequeue_script( 'wc-password-strength-meter' ); } } I found the solution here.


11

I wonder if you're looking for this one: /** * Fires after the user's password is reset. * * @since 4.4.0 * * @param object $user The user. * @param string $new_pass New user password. */ do_action( 'after_password_reset', $user, $new_pass ); It was introduced in WordPress 4.4 and lives within the reset_password() function. The ...


10

Password is not unique all the time. According to worst password statistics, password is the most used Password of all time. I'm pretty sure some of your users too use that password. So multiple rows will contain the same hash. Hence its not possible. By the way, this is a weird question.


10

The "correct" answer doesn't work here because the action 'password_reset' fires before the password is reset. I modified the first answer, before the update, to work. function wpse_lost_password_redirect() { // Check if have submitted $confirm = ( isset($_GET['action'] ) && $_GET['action'] == resetpass ); if( $confirm ) { ...


10

After much research, I finally turned to examining the WordPress core file wp_login.php hoping that WP would show how they do it in a non-obtuse manner. From the information around line 331 (WP 4.6.1), I put together the following code. <?php global $gw_activate_template; extract( $gw_activate_template->result ); $url = is_multisite() ? ...


10

The problem is the < and > which surround the reset URL in wp-login.php. You can remove them using retrieve_password_message in your theme functions.php file like below: add_filter("retrieve_password_message", "mapp_custom_password_reset", 99, 4); function mapp_custom_password_reset($message, $key, $user_login, $user_data ) { $message = "...


9

Here is an updated version of the code from @bainternet with the syntax errors corrected, the suggestion by @Val and the key generator from wp-login.php 3.4.2: global $wpdb; $username = trim($_POST['user_login']); $user_exists = false; // First check by username if ( username_exists( $username ) ){ $user_exists = true; $user = get_user_by('login', $...


9

Here is a simple solution. Im hooking into login_headerurl. Maybe there is a better hook for this but it works, Put this in your functions.php: function wpse_lost_password_redirect() { // Check if have submitted $confirm = ( isset($_GET['checkemail'] ) ? $_GET['checkemail'] : '' ); if( $confirm ) { wp_redirect( home_url() ); ...


9

You want the filters... retrieve_password_message for the actual email content. Your hooked function will get the message as the first argument and the user's reset key as the second. <?php add_filter('retrieve_password_message', 'wpse103299_reset_msg', 10, 2); function wpse103299_reset_msg($message, $reset_key) { // ... } retrieve_password_title ...


9

You can intercept this email before it is sent using the phpmailer_init hook. By default, this hook fires before any email is sent. In the function below, $phpmailer will be an instance of PHPMailer, and you can use its methods to remove the default recipient and manipulate the email before it is sent. add_action('phpmailer_init', '...


9

Here's just a demo test for fun, just to see if this might be possible: Demo First we set the post's password, the usual way: Then we create a custom field called wpse_extra_passwords that takes comma seperated passwords: These are the extra passwords for that post. Let's define the following helper function, based on the post_password_required() core ...


9

There is no absolutely safe way to store such information permanently. You have two options to increase security a little bit: Use the options table and encrypt the data Use a strong encryption method, and bind it to either: your password when you want to use the API call only when you are logged in, or a secret key stored in your wp-config.php – then an ...


8

WordPress has this already built in essentially. It's not clear how you are processing the form, but when you register the user, just call: update_user_option( $user_id, 'default_password_nag', true, true ); Alternatively (if that's not possible?) you can use a hook: add_action('user_register', 'wpse72788_password_nag'); function wpse72788_password_nag( $...


8

I noticed that after upgrading WordPress to Version 4.3 that the above no longer worked for my custom plugin. It would always report that the key was invalid. Change: $hashed = $wp_hasher->HashPassword( $key ); to $hashed = time() . ':' . $wp_hasher->HashPassword( $key ); This fixed the issue for me, hope it helps someone else


8

WordPress uses custom wp_mail function, so you won't find it, if you'll search for mail. Just take a look at line 248 of wp-login.php file: http://core.trac.wordpress.org/browser/branches/3.5/wp-login.php#L248 You should find retrieve_password_message filter call there. This is the filter that returns the content of reset password message. You should also ...


8

It is a bug in wp-members plugin. Others have reported the same error. http://user-meta.com/forums/topic/able-to-save-plain-text-passwords-as-a-user-meta-value/ http://wordpress.org/support/topic/wp-member-passwords-are-stored-in-clear-text-in-database-highly-insecure


8

the given answers have good intentions. But are not good. There are more parameters to the filter function call, 4 to be exact. this worked for me for the message (i wanted to replace username with user email) note we have a multi site page. You might want to replace network_site_url with get_site_url() typically in your functions.php of your wordpress ...


8

You shouldn't have to send them passwords. That's a bad idea. Instead, make sure your web server has email setup properly and your user accounts have the correct email addresses. Then all you'll have to do is send them the link to the Forgot Password link provided by WordPress by default. It looks like this: http://example.com/wp-login.php?action=...


7

None of the above answer worked for me so I looked into wp-login.php for their default reset functionality. They used get_password_reset_key( $userData ) function . In case someone stuck up on above answers here's my solution :- $userData = get_userdata($user_id); $user_login = $userData->user_login; $...


7

Actually you can bypass login mechanism of wordpress by login user automatically (after they succesfuly passed with credentials from another website for example) with this function: wp_set_auth_cookie($user_id); for example with this you do login admin (user with id = 1) wp_set_auth_cookie(1); //after this admin is logged in so you can create user in ...


Only top voted, non community-wiki answers of a minimum length are eligible