26

So if you want to send that the reset password link and you have access to the code base you can use the following snippet and you can modify it further, actually that code is slightly modified version of wp-login.php /** * Handles sending password retrieval email to user. * * @uses $wpdb WordPress Database object * @param string $user_login User Login ...


25

This does the trick: wp user update USERNAME --user_pass="PASSWORD" (Found it here.)


20

Previous answer didn't worked for me (says that code is invalid, on wp login page), probably because answer is 1,5 yr old, and something is changed in WP code, so I have updated this code a bit (also from wp-login.php), here it is: function retrieve_password($user_login){ global $wpdb, $wp_hasher; $user_login = sanitize_text_field($user_login); ...


15

You cannot export passwords as plaintext in WordPress, because they are not stored in plaintext. What you see here is obviously the result of a very bad plugin. Fields like Payment, Sex or Company are not even part of the regular WordPress tables. For the future: Do not install plugins without prior tests and reviews in a safe environment. Use a local ...


14

first check the user name: wp user list then change password without leaving traces in history wp user update admin --prompt=user_pass


13

the solution is simple, there is a filter to change the lost password url. Try this : add_filter( 'lostpassword_url', 'wdm_lostpassword_url', 10, 0 ); function wdm_lostpassword_url() { return site_url('/signin?action=lostpassword'); }


12

When you select password protected option in page back-end, It by-default works for content only. i.e. the_content() But if you want to password protect whole page or have a custom template, you need to have the following structure. <?php global $post; get_header(); if ( ! post_password_required( $post ) ) { // Your custom code should here }else{ ...


11

Its Not has hard as you think it is :) Add the password fields to your form : password: <input type="password" name="pass1" style="width:250px; margin-bottom:3px;"><br /> repeat password: <input type="password" name="pass2" style="width:250px; margin-bottom:3px;"><br /> then in your if($_POST){ replace this line: $random_password ...


11

I wonder if you're looking for this one: /** * Fires after the user's password is reset. * * @since 4.4.0 * * @param object $user The user. * @param string $new_pass New user password. */ do_action( 'after_password_reset', $user, $new_pass ); It was introduced in WordPress 4.4 and lives within the reset_password() function. The ...


10

The latest entered password is stored as a secure hash in a cookie named 'wp-postpass_' . COOKIEHASH. When the password form is called, that cookie has been validated already by WordPress. So you just have to check if that cookie exists: If it does and the password form is displayed, the password was wrong. add_filter( 'the_password_form', '...


10

Password is not unique all the time. According to worst password statistics, password is the most used Password of all time. I'm pretty sure some of your users too use that password. So multiple rows will contain the same hash. Hence its not possible. By the way, this is a weird question.


10

The "correct" answer doesn't work here because the action 'password_reset' fires before the password is reset. I modified the first answer, before the update, to work. function wpse_lost_password_redirect() { // Check if have submitted $confirm = ( isset($_GET['action'] ) && $_GET['action'] == resetpass ); if( $confirm ) { ...


10

Just figured it out. So thought to leave the solution here, if someone else need it: To change the default hashing system, need to overwrite wp_hash_password() function: (can be done in a plugin) if ( !function_exists('wp_hash_password') ){ function wp_hash_password($password) { //apply your own hashing structure here return ...


10

The password strength meter in the latest versions of WordPress uses a library called "zxcvbn", made by Dropbox in 2012. The library is available for free on Github: https://github.com/dropbox/zxcvbn An explanation of the library is here: https://blogs.dropbox.com/tech/2012/04/zxcvbn-realistic-password-strength-estimation/ But the short version is that it ...


10

This will do it :-) add_action( 'wp_print_scripts', 'DisableStrongPW', 100 ); function DisableStrongPW() { if ( wp_script_is( 'wc-password-strength-meter', 'enqueued' ) ) { wp_dequeue_script( 'wc-password-strength-meter' ); } } I found the solution here.


10

The problem is the < and > which surround the reset URL in wp-login.php. You can remove them using retrieve_password_message in your theme functions.php file like below: add_filter("retrieve_password_message", "mapp_custom_password_reset", 99, 4); function mapp_custom_password_reset($message, $key, $user_login, $user_data ) { $message = "...


9

Here is a simple solution. Im hooking into login_headerurl. Maybe there is a better hook for this but it works, Put this in your functions.php: function wpse_lost_password_redirect() { // Check if have submitted $confirm = ( isset($_GET['checkemail'] ) ? $_GET['checkemail'] : '' ); if( $confirm ) { wp_redirect( home_url() ); ...


9

You want the filters... retrieve_password_message for the actual email content. Your hooked function will get the message as the first argument and the user's reset key as the second. <?php add_filter('retrieve_password_message', 'wpse103299_reset_msg', 10, 2); function wpse103299_reset_msg($message, $reset_key) { // ... } retrieve_password_title ...


9

You can intercept this email before it is sent using the phpmailer_init hook. By default, this hook fires before any email is sent. In the function below, $phpmailer will be an instance of PHPMailer, and you can use its methods to remove the default recipient and manipulate the email before it is sent. add_action('phpmailer_init', '...


9

Here's just a demo test for fun, just to see if this might be possible: Demo First we set the post's password, the usual way: Then we create a custom field called wpse_extra_passwords that takes comma seperated passwords: These are the extra passwords for that post. Let's define the following helper function, based on the post_password_required() core ...


9

There is no absolutely safe way to store such information permanently. You have two options to increase security a little bit: Use the options table and encrypt the data Use a strong encryption method, and bind it to either: your password when you want to use the API call only when you are logged in, or a secret key stored in your wp-config.php – then an ...


9

After much research, I finally turned to examining the WordPress core file wp_login.php hoping that WP would show how they do it in a non-obtuse manner. From the information around line 331 (WP 4.6.1), I put together the following code. <?php global $gw_activate_template; extract( $gw_activate_template->result ); $url = is_multisite() ? ...


8

Here is an updated version of the code from @bainternet with the syntax errors corrected, the suggestion by @Val and the key generator from wp-login.php 3.4.2: global $wpdb; $username = trim($_POST['user_login']); $user_exists = false; // First check by username if ( username_exists( $username ) ){ $user_exists = true; $user = get_user_by('login', $...


8

WordPress has this already built in essentially. It's not clear how you are processing the form, but when you register the user, just call: update_user_option( $user_id, 'default_password_nag', true, true ); Alternatively (if that's not possible?) you can use a hook: add_action('user_register', 'wpse72788_password_nag'); function wpse72788_password_nag( $...


8

WordPress uses custom wp_mail function, so you won't find it, if you'll search for mail. Just take a look at line 248 of wp-login.php file: http://core.trac.wordpress.org/browser/branches/3.5/wp-login.php#L248 You should find retrieve_password_message filter call there. This is the filter that returns the content of reset password message. You should also ...


8

It is a bug in wp-members plugin. Others have reported the same error. http://user-meta.com/forums/topic/able-to-save-plain-text-passwords-as-a-user-meta-value/ http://wordpress.org/support/topic/wp-member-passwords-are-stored-in-clear-text-in-database-highly-insecure


8

You shouldn't have to send them passwords. That's a bad idea. Instead, make sure your web server has email setup properly and your user accounts have the correct email addresses. Then all you'll have to do is send them the link to the Forgot Password link provided by WordPress by default. It looks like this: http://example.com/wp-login.php?action=...


7

I noticed that after upgrading WordPress to Version 4.3 that the above no longer worked for my custom plugin. It would always report that the key was invalid. Change: $hashed = $wp_hasher->HashPassword( $key ); to $hashed = time() . ':' . $wp_hasher->HashPassword( $key ); This fixed the issue for me, hope it helps someone else


7

WordPress sends an email to the admin's email when a user resets their password. To get a notification when a user changes their password you could hook into the profile_update action which is fired when a user's profile is updated. When the action is fired WordPress has already validated and updated the user's details we only need to check if the user ...


7

When you set a post as password protected, the protection happen on get_the_content() function. There WordPress check for a post password cookie, and if not set, not valid or expired then show the password form. This password form is submitted to wp-login.php, there a cookie is setted according to the password wrote in the form, then the request is ...


Only top voted, non community-wiki answers of a minimum length are eligible