# Front-End Change Password Form

> Adds a [wpide_change_password] shortcode where members change their password by entering the current one and the new one twice, and stay logged in afterwards.

- Type: PHP
- Runs: Run everywhere
- Category: [Users](https://wpide.com/library/category/users/)
- Tags: password, shortcode, account
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/frontend-change-password-form/

## Code

```php
// Minimum length for new passwords.
$wpide_new_pass_min = 10;
$wpide_pass_error   = '';

add_action( 'template_redirect', function () use ( $wpide_new_pass_min, &$wpide_pass_error ) {
    if ( empty( $_POST['wpide_pass_nonce'] ) || ! is_user_logged_in() ) {
        return;
    }

    if ( ! wp_verify_nonce( sanitize_key( $_POST['wpide_pass_nonce'] ), 'wpide_change_password' ) ) {
        $wpide_pass_error = 'The form expired. Please try again.';
        return;
    }

    $user    = wp_get_current_user();
    $current = isset( $_POST['wpide_current_pass'] ) ? (string) wp_unslash( $_POST['wpide_current_pass'] ) : '';
    $new     = isset( $_POST['wpide_new_pass'] ) ? (string) wp_unslash( $_POST['wpide_new_pass'] ) : '';
    $confirm = isset( $_POST['wpide_confirm_pass'] ) ? (string) wp_unslash( $_POST['wpide_confirm_pass'] ) : '';

    if ( ! wp_check_password( $current, $user->user_pass, $user->ID ) ) {
        $wpide_pass_error = 'Your current password is not correct.';
    } elseif ( strlen( $new ) < $wpide_new_pass_min ) {
        $wpide_pass_error = sprintf( 'The new password must be at least %d characters.', $wpide_new_pass_min );
    } elseif ( $new !== $confirm ) {
        $wpide_pass_error = 'The new passwords do not match.';
    }

    if ( $wpide_pass_error ) {
        return;
    }

    wp_set_password( $new, $user->ID );
    // Setting the password ends every session, so start a fresh one here.
    wp_set_current_user( $user->ID );
    wp_set_auth_cookie( $user->ID );

    wp_safe_redirect( add_query_arg( 'password-changed', 1 ) );
    exit;
} );

add_shortcode( 'wpide_change_password', function () use ( $wpide_new_pass_min, &$wpide_pass_error ) {
    if ( ! is_user_logged_in() ) {
        return '';
    }

    ob_start();

    if ( isset( $_GET['password-changed'] ) ) {
        echo '<p class="wpide-pass-notice" role="status">Your password has been changed.</p>';
    } elseif ( $wpide_pass_error ) {
        echo '<p class="wpide-pass-error" role="alert">' . esc_html( $wpide_pass_error ) . '</p>';
    }
    ?>
    <form class="wpide-change-password" method="post">
        <p><label for="wpide-current-pass">Current password</label><br><input type="password" id="wpide-current-pass" name="wpide_current_pass" autocomplete="current-password" required></p>
        <p><label for="wpide-new-pass">New password</label><br><input type="password" id="wpide-new-pass" name="wpide_new_pass" autocomplete="new-password" minlength="<?php echo (int) $wpide_new_pass_min; ?>" required></p>
        <p><label for="wpide-confirm-pass">Confirm new password</label><br><input type="password" id="wpide-confirm-pass" name="wpide_confirm_pass" autocomplete="new-password" required></p>
        <?php wp_nonce_field( 'wpide_change_password', 'wpide_pass_nonce' ); ?>
        <p><button type="submit">Change password</button></p>
    </form>
    <?php
    return ob_get_clean();
} );
```

## Notes

Other devices are logged out when the password changes, which is what WordPress does on the profile screen too.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Front-End Change Password Form" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/