# Prevent Reusing Any of the Last 5 Passwords

> Remembers the last five password hashes of each user and refuses a new password that matches one of them, on the profile screen and on password reset.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: passwords, policy, users
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/sec-password-history/

## Code

```php
// Number of previous passwords that cannot be reused.
$wpide_history_size = 5;

$wpide_is_reused = function ( $user_id, $password ) {
    $user = get_userdata( $user_id );

    if ( ! $user || '' === (string) $password ) {
        return false;
    }

    $hashes   = (array) get_user_meta( $user_id, 'wpide_password_history', true );
    $hashes[] = $user->user_pass;

    foreach ( array_filter( $hashes ) as $hash ) {
        if ( wp_check_password( $password, $hash, $user_id ) ) {
            return true;
        }
    }

    return false;
};

$wpide_remember = function ( $user_id, $old_hash ) use ( $wpide_history_size ) {
    $hashes   = array_filter( (array) get_user_meta( $user_id, 'wpide_password_history', true ) );
    $hashes[] = $old_hash;
    update_user_meta( $user_id, 'wpide_password_history', array_slice( array_values( array_unique( $hashes ) ), -$wpide_history_size ) );
};

add_action( 'user_profile_update_errors', function ( $errors, $update, $user ) use ( $wpide_is_reused ) {
    if ( $update && ! empty( $user->user_pass ) && ! empty( $user->ID ) && $wpide_is_reused( $user->ID, $user->user_pass ) ) {
        $errors->add( 'wpide_password_reused', '<strong>Error:</strong> Please choose a password you have not used recently.' );
    }
}, 10, 3 );

add_action( 'validate_password_reset', function ( $errors, $user ) use ( $wpide_is_reused ) {
    $pass = isset( $_POST['pass1'] ) ? (string) wp_unslash( $_POST['pass1'] ) : '';
    if ( $pass && $user instanceof WP_User && $wpide_is_reused( $user->ID, $pass ) ) {
        $errors->add( 'wpide_password_reused', 'Please choose a password you have not used recently.' );
    }
}, 10, 2 );

add_action( 'profile_update', function ( $user_id, $old_data ) use ( $wpide_remember ) {
    $user = get_userdata( $user_id );
    if ( $user && $old_data && $old_data->user_pass && $user->user_pass !== $old_data->user_pass ) {
        $wpide_remember( $user_id, $old_data->user_pass );
    }
}, 10, 2 );

add_action( 'password_reset', function ( $user ) use ( $wpide_remember ) {
    $wpide_remember( $user->ID, $user->user_pass );
} );
```

## Notes

Only hashes are stored, never the passwords themselves; history starts building from the next password change.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Prevent Reusing Any of the Last 5 Passwords" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/