51
votes
Accepted
How to change user password with wp-cli?
This does the trick:
wp user update USERNAME --user_pass="PASSWORD"
(Found it here.)
- 1,347
21
votes
How to change user password with wp-cli?
first check the user name:
wp user list
then change password without leaving traces in history
wp user update admin --prompt=user_pass
- 344
16
votes
Accepted
Why does hashing a password result in different hashes, each time?
By default, each time a new hash is generated (e.g. wp_hash_password()) WordPress salts it with random bytes, producing a unique hash for each call. The string returned from wp_hash_password() ...
- 6,555
14
votes
Accepted
How do I create a password reset link?
After much research, I finally turned to examining the WordPress core file wp_login.php hoping that WP would show how they do it in a non-obtuse manner. From the information around line 331 (WP 4.6.1)...
- 331
13
votes
Loosen/disable password policy
This will do it :-)
add_action( 'wp_print_scripts', 'DisableStrongPW', 100 );
function DisableStrongPW() {
if ( wp_script_is( 'wc-password-strength-meter', 'enqueued' ) ) {
...
- 429
11
votes
Accepted
How is password strength calculated?
The password strength meter in the latest versions of WordPress uses a library called "zxcvbn", made by Dropbox in 2012.
The library is available for free on Github: https://github.com/dropbox/zxcvbn
...
- 32.4k
11
votes
Sending the reset password link programatically
None of the above answer worked for me so I looked into wp-login.php for their default reset functionality. They used get_password_reset_key( $userData ) function . In case someone stuck up on above ...
- 753
11
votes
Accepted
Hook *after* user password change?
I wonder if you're looking for this one:
/**
* Fires after the user's password is reset.
*
* @since 4.4.0
*
* @param object $user The user.
* @param string $new_pass New user ...
- 65.6k
10
votes
Accepted
Disable user registration password email
You can intercept this email before it is sent using the phpmailer_init hook.
By default, this hook fires before any email is sent. In the function below, $phpmailer will be an instance of ...
- 528
10
votes
Accepted
Where to securely store API keys and passwords in WordPress?
There is no absolutely safe way to store such information permanently.
You have two options to increase security a little bit:
Use the options table and encrypt the data
Use a strong encryption ...
- 106k
10
votes
Accepted
Missing URL in password reset email
The problem is the < and > which surround the reset URL in wp-login.php. You can remove them using retrieve_password_message in your theme functions.php file like below:
add_filter("...
- 330
10
votes
Accepted
Best way to send users password?
You shouldn't have to send them passwords. That's a bad idea.
Instead, make sure your web server has email setup properly and your user accounts have the correct email addresses. Then all you'll have ...
- 8,679
9
votes
How to apply the "retrieve_password_message" filter?
the given answers have good intentions. But are not good. There are more parameters to the filter function call, 4 to be exact.
this worked for me for the message (i wanted to replace username with ...
- 504
9
votes
Accepted
Password protect page with multiple passwords
Here's just a demo test for fun, just to see if this might be possible:
Demo
First we set the post's password, the usual way:
Then we create a custom field called wpse_extra_passwords that takes ...
- 65.6k
9
votes
Accepted
If I change the salt keys in my wp-config will all passwords break?
No the passwords won't break (those are in the database and aren't changed by changing the salt). However all logged-in users will have to login again.
More on Salts here.
Note: Updating your ...
- 410
9
votes
How can I modify the default reset (lost) password email text?
To answer your specific question, "How can I modify the default reset (lost) password email text," the answer would be to use the retrieve_password_message filter. And ultimately that might be a way ...
- 4,806
8
votes
Sending the reset password link programatically
I noticed that after upgrading WordPress to Version 4.3 that the above no longer worked for my custom plugin. It would always report that the key was invalid.
Change:
$hashed = $wp_hasher->...
- 191
8
votes
Accepted
How to add Wp_error using lostpassword_post hook when validating custom field?
As of WordPress 4.4, the action lostpassword_post passes the $errors object:
function wpse_185243_lastpassword_post( $errors ) {
if ( ! $captcha_valid /* The result of your captcha */ ) {
...
- 36.1k
8
votes
Accepted
Conditional to test if post has password protection enabled
You could use
if(!empty($post->post_password)){
// do some stuff
}
which is what the post_password_required() code does before checking the user's credentials against the password itself.
- 871
7
votes
How do I require authorization / login to view a specific set of posts / pages?
This is just a modification of timshutes' answer - if you want specific pages to require login and don't want to put them into a custom post type, you can add to functions.php:
add_shortcode('...
- 271
7
votes
Password Reset for Users on a Multisite Subsite
This works well!
"By default, WordPress Multisite uses the main blog for passwort resets. This plugin enables users to stay in their blog during the whole reset process."
<?php
/**
* Plugin Name:...
- 71
7
votes
How to make page/post password protected so you must reenter everytime you visit the page?
Stop what you're doing - it's so much simpler!
function wpse_191369_post_password_expires() {
return time() + 10; // Expire in 10 seconds
}
add_filter( 'post_password_expires', '...
- 36.1k
7
votes
Accepted
Problems after wp_set_password() containing an apostrophe
The resolution is pretty simply. Those functions require the passwords to be properly escaped. So
Instead of this:
wp_set_password('Test"123', $userId);
You have to do this:
wp_set_password(...
- 197
7
votes
Accepted
Change Password notification text on mail
If I understand you correctly, then you only want to change the text of the mail. This you can do via the filter hook password_change_email. No need to redeclare the function, which you actually can't ...
- 18.5k
7
votes
Accepted
Change default recovery link expiration time
I would think this would change it to a month:
add_filter( 'password_reset_expiration', function( $expiration ) {
return MONTH_IN_SECONDS;
});
using the built-in MONTH_IN_SECONDS constant.
For ...
- 65.6k
6
votes
How can I change the email sender name from wordpress to (myblogname) on the "lost password" email?
If you have a custom login page already, you may not want to introduce a whole new plugin. You can change 'from' name and email with these simple functions in your theme or plugin.
To change the name
...
- 860
6
votes
Reset Password - change from name and email address
Use the following code in your active theme's functions.php file. No need to hard code your email address and blog name, this gets both as given in WordPress Settings > General.
add_filter( '...
- 161
6
votes
Where to securely store API keys and passwords in WordPress?
The answer is NO. If your DB can be spied on, your code probably can be as well so even if you encrypt data it can be decrypted.
If you are going to store sensitive data there are no low level ...
- 23.1k
5
votes
Accepted
Remove lost password form and URL
Hi Please try to use this in your functions.php it will redirect user to login form when user try to access lost password page:
add_action('init','possibly_redirect');
function possibly_redirect(){
...
- 1,457
5
votes
Accepted
Bypass password protected posts via GET variable
The check for a post password happens (for some reason) inside get_the_content(), which seems legit, but actually mixes together two separate concerns. You were right with the statement that there is ...
- 50.2k
Only top scored, non community-wiki answers of a minimum length are eligible