# Hide Whether an Account Exists on Password Reset

> Shows the same "check your email" screen for unknown usernames and emails on the lost password form, so it cannot be used to find valid accounts.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: security, passwords, enumeration
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/hide-account-existence-on-reset/

## Code

```php
add_filter( 'lostpassword_errors', function ( $errors, $user_data ) {
    if ( $user_data || 'wp-login.php' !== ( isset( $GLOBALS['pagenow'] ) ? $GLOBALS['pagenow'] : '' ) ) {
        return $errors;
    }

    $codes = $errors->get_error_codes();

    // Unknown account: pretend the email was sent.
    if ( empty( $codes ) || array( 'invalid_email' ) === $codes ) {
        wp_safe_redirect( add_query_arg( 'checkemail', 'confirm', wp_login_url() ) );
        exit;
    }

    return $errors;
}, 99, 2 );
```

## Notes

Registration forms can still reveal existing emails; disable public registration if that matters.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Hide Whether an Account Exists on Password Reset" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/