50 votes
Accepted

How to change user password with wp-cli?

This does the trick: wp user update USERNAME --user_pass="PASSWORD" (Found it here.)
  • 1,327
21 votes

How to change user password with wp-cli?

first check the user name: wp user list then change password without leaving traces in history wp user update admin --prompt=user_pass
16 votes
Accepted

How to change/rewrite the lost password url?

the solution is simple, there is a filter to change the lost password url. Try this : add_filter( 'lostpassword_url', 'wdm_lostpassword_url', 10, 0 ); function wdm_lostpassword_url() { return ...
  • 3,154
16 votes
Accepted

Why does hashing a password result in different hashes, each time?

By default, each time a new hash is generated (e.g. wp_hash_password()) WordPress salts it with random bytes, producing a unique hash for each call. The string returned from wp_hash_password() ...
  • 6,335
15 votes
Accepted

Why are passwords exportable as plain text in WordPress?

You cannot export passwords as plaintext in WordPress, because they are not stored in plaintext. What you see here is obviously the result of a very bad plugin. Fields like Payment, Sex or Company ...
  • 105k
14 votes
Accepted

How do I create a password reset link?

After much research, I finally turned to examining the WordPress core file wp_login.php hoping that WP would show how they do it in a non-obtuse manner. From the information around line 331 (WP 4.6.1)...
  • 331
13 votes

Loosen/disable password policy

This will do it :-) add_action( 'wp_print_scripts', 'DisableStrongPW', 100 ); function DisableStrongPW() { if ( wp_script_is( 'wc-password-strength-meter', 'enqueued' ) ) { ...
  • 429
11 votes

wordpress redirect after password reset

The "correct" answer doesn't work here because the action 'password_reset' fires before the password is reset. I modified the first answer, before the update, to work. function ...
11 votes

Sending the reset password link programatically

None of the above answer worked for me so I looked into wp-login.php for their default reset functionality. They used get_password_reset_key( $userData ) function . In case someone stuck up on above ...
11 votes
Accepted

How is password strength calculated?

The password strength meter in the latest versions of WordPress uses a library called "zxcvbn", made by Dropbox in 2012. The library is available for free on Github: https://github.com/dropbox/zxcvbn ...
  • 32.2k
11 votes
Accepted

Hook *after* user password change?

I wonder if you're looking for this one: /** * Fires after the user's password is reset. * * @since 4.4.0 * * @param object $user The user. * @param string $new_pass New user ...
  • 64.7k
10 votes
Accepted

Disable user registration password email

You can intercept this email before it is sent using the phpmailer_init hook. By default, this hook fires before any email is sent. In the function below, $phpmailer will be an instance of ...
10 votes
Accepted

Where to securely store API keys and passwords in WordPress?

There is no absolutely safe way to store such information permanently. You have two options to increase security a little bit: Use the options table and encrypt the data Use a strong encryption ...
  • 105k
10 votes
Accepted

Missing URL in password reset email

The problem is the < and > which surround the reset URL in wp-login.php. You can remove them using retrieve_password_message in your theme functions.php file like below: add_filter("...
10 votes
Accepted

Best way to send users password?

You shouldn't have to send them passwords. That's a bad idea. Instead, make sure your web server has email setup properly and your user accounts have the correct email addresses. Then all you'll have ...
  • 7,284
9 votes

How to apply the "retrieve_password_message" filter?

the given answers have good intentions. But are not good. There are more parameters to the filter function call, 4 to be exact. this worked for me for the message (i wanted to replace username with ...
  • 504
9 votes
Accepted

Password protect page with multiple passwords

Here's just a demo test for fun, just to see if this might be possible: Demo First we set the post's password, the usual way: Then we create a custom field called wpse_extra_passwords that takes ...
  • 64.7k
9 votes
Accepted

If I change the salt keys in my wp-config will all passwords break?

No the passwords won't break (those are in the database and aren't changed by changing the salt). However all logged-in users will have to login again. More on Salts here. Note: Updating your ...
8 votes

Why are passwords exportable as plain text in WordPress?

It is a bug in wp-members plugin. Others have reported the same error. http://user-meta.com/forums/topic/able-to-save-plain-text-passwords-as-a-user-meta-value/ http://wordpress.org/support/topic/wp-...
8 votes

Sending the reset password link programatically

I noticed that after upgrading WordPress to Version 4.3 that the above no longer worked for my custom plugin. It would always report that the key was invalid. Change: $hashed = $wp_hasher->...
8 votes
Accepted

How to add Wp_error using lostpassword_post hook when validating custom field?

As of WordPress 4.4, the action lostpassword_post passes the $errors object: function wpse_185243_lastpassword_post( $errors ) { if ( ! $captcha_valid /* The result of your captcha */ ) { ...
  • 35.8k
8 votes
Accepted

Conditional to test if post has password protection enabled

You could use if(!empty($post->post_password)){ // do some stuff } which is what the post_password_required() code does before checking the user's credentials against the password itself.
8 votes

How can I modify the default reset (lost) password email text?

To answer your specific question, "How can I modify the default reset (lost) password email text," the answer would be to use the retrieve_password_message filter. And ultimately that might be a way ...
  • 4,460
7 votes

Password Reset for Users on a Multisite Subsite

This works well! "By default, WordPress Multisite uses the main blog for passwort resets. This plugin enables users to stay in their blog during the whole reset process." <?php /** * Plugin Name:...
  • 71
7 votes

How to make page/post password protected so you must reenter everytime you visit the page?

Stop what you're doing - it's so much simpler! function wpse_191369_post_password_expires() { return time() + 10; // Expire in 10 seconds } add_filter( 'post_password_expires', '...
  • 35.8k
7 votes
Accepted

Problems after wp_set_password() containing an apostrophe

The resolution is pretty simply. Those functions require the passwords to be properly escaped. So Instead of this: wp_set_password('Test"123', $userId); You have to do this: wp_set_password(...
  • 197
7 votes
Accepted

Change Password notification text on mail

If I understand you correctly, then you only want to change the text of the mail. This you can do via the filter hook password_change_email. No need to redeclare the function, which you actually can't ...
7 votes
Accepted

Change default recovery link expiration time

I would think this would change it to a month: add_filter( 'password_reset_expiration', function( $expiration ) { return MONTH_IN_SECONDS; }); using the built-in MONTH_IN_SECONDS constant. For ...
  • 64.7k
6 votes

Reset Password - change from name and email address

Use the following code in your active theme's functions.php file. No need to hard code your email address and blog name, this gets both as given in WordPress Settings > General. add_filter( '...
6 votes

How do I require authorization / login to view a specific set of posts / pages?

This is just a modification of timshutes' answer - if you want specific pages to require login and don't want to put them into a custom post type, you can add to functions.php: add_shortcode('...
  • 261

Only top scored, non community-wiki answers of a minimum length are eligible