# Password Reset by Email Address Only

> Makes the "Lost your password?" form accept only an email address, not a username, so the form can't be used to probe which usernames exist.

- Type: PHP
- Runs: Run everywhere
- Category: [Login](https://wpide.com/library/category/login/)
- Tags: password, security, login
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/password-reset-email-only/

## Code

```php
add_action( 'lostpassword_post', function ( $errors ) {
    $value = isset( $_POST['user_login'] ) ? sanitize_text_field( wp_unslash( $_POST['user_login'] ) ) : '';

    if ( '' !== $value && ! is_email( $value ) ) {
        $errors->add( 'wpide_email_only', '<strong>Error:</strong> Please enter the email address of your account.' );
    }
} );

add_filter( 'gettext', function ( $translation, $text, $domain ) {
    if ( 'default' === $domain && 'Username or Email Address' === $text && isset( $GLOBALS['pagenow'] ) && 'wp-login.php' === $GLOBALS['pagenow'] && isset( $_GET['action'] ) && 'lostpassword' === $_GET['action'] ) {
        return 'Email address';
    }

    return $translation;
}, 10, 3 );
```

## Notes

The field label changes to "Email address" to match.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Password Reset by Email Address Only" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/