Password Reset by Email Address Only
Makes the "Lost your password?" form accept only an email address, not a username, so the form can't be used to probe which usernames exist.
Opens WPIDE on
Code
add_action( 'lostpassword_post', function ( $errors ) {
$value = isset( $_POST['user_login'] ) ? sanitize_text_field( wp_unslash( $_POST['user_login'] ) ) : '';
if ( '' !== $value && ! is_email( $value ) ) {
$errors->add( 'wpide_email_only', '<strong>Error:</strong> Please enter the email address of your account.' );
}
} );
add_filter( 'gettext', function ( $translation, $text, $domain ) {
if ( 'default' === $domain && 'Username or Email Address' === $text && isset( $GLOBALS['pagenow'] ) && 'wp-login.php' === $GLOBALS['pagenow'] && isset( $_GET['action'] ) && 'lostpassword' === $_GET['action'] ) {
return 'Email address';
}
return $translation;
}, 10, 3 );Notes
The field label changes to "Email address" to match.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.