Hide Whether an Account Exists on Password Reset
Shows the same "check your email" screen for unknown usernames and emails on the lost password form, so it cannot be used to find valid accounts.
Opens WPIDE on
Code
add_filter( 'lostpassword_errors', function ( $errors, $user_data ) {
if ( $user_data || 'wp-login.php' !== ( isset( $GLOBALS['pagenow'] ) ? $GLOBALS['pagenow'] : '' ) ) {
return $errors;
}
$codes = $errors->get_error_codes();
// Unknown account: pretend the email was sent.
if ( empty( $codes ) || array( 'invalid_email' ) === $codes ) {
wp_safe_redirect( add_query_arg( 'checkemail', 'confirm', wp_login_url() ) );
exit;
}
return $errors;
}, 99, 2 );Notes
Registration forms can still reveal existing emails; disable public registration if that matters.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.