customization - Removing "There is no account with that username or email address." error message in &quot

admin管理员组

文章数量:1122832

Would like to find out if there is any way I could customize the wp_login page to remove the "There is no account with that username or email address." validation (show below)

and any email/username entered are all redirected to this check email page instead?

I understand making change to wp-login.php is not advisable.
Seeking experts here for recommendation and advise.

Thanks in advance!

Would like to find out if there is any way I could customize the wp_login page to remove the "There is no account with that username or email address." validation (show below)

and any email/username entered are all redirected to this check email page instead?

I understand making change to wp-login.php is not advisable.
Seeking experts here for recommendation and advise.

Thanks in advance!

• php
• customization
• hooks
• login
• wp-login-form

Share Improve this question asked Nov 15, 2021 at 9:06 BBBBB86BBBBB86 2366 bronze badges 4

• if sending a confirmation link is possible then that first screen should be impossible, can you explain the problem that this would solve for you? Doing this would have negative security consequences as it would be possible to list unconfirmed users for exploitation – Tom J Nowell ♦ Commented Nov 15, 2021 at 10:01
• Hi Tom, my intention of removing this email check validation is to prevent user enumeration attacks. Without this validation in place, there is no longer a "hint" made known to an attacker to guess or confirm if the email entered is a valid account to my WP portal. – BBBBB86 Commented Nov 16, 2021 at 0:47
• Do you mean that if I disable the validation check, the confirmation link will be sent out regardless the email entered is a valid or a non-existing account in my portal? I think this can be customized on the PHP end to prevent that right? – BBBBB86 Commented Nov 16, 2021 at 1:01
• I believe I misunderstood – Tom J Nowell ♦ Commented Aug 14, 2023 at 9:14

Add a comment  | 

1 Answer 1

Sorted by: Reset to default 0

On a successful lost password email send, Wordpress forwards to the login page with the query string ?checkemail=confirm. So we can happily just manually redirect to this page when we evaluate that the lostpassword form is being shown after the user made a post request. Then we can update the confirmation text to suit our needs.

add_action( 'lost_password', 'prevent_lost_password_enumeration', 10, 1 );
add_filter( 'gettext', 'change_lost_password_email_sent_notice', 10, 3 );

function prevent_lost_password_enumeration($errors) {

    $http_post = 'POST' === $_SERVER['REQUEST_METHOD'];

    if (!$http_post) return;

    //Allow an empty message to show
    if (empty(trim(strval($_POST['user_login'] ?? '')))) return;

    $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : 'wp-login.php?checkemail=confirm';

    wp_safe_redirect($redirect_to);
    exit;

}

public function change_lost_password_email_sent_notice($translated_text, $text, $domain) {

    $default = 'Check your email for the confirmation link, then visit the <a href="%s">login page</a>.';
    
    if ($default !== $text) return $translated_text;

    $new = 'If your email address exists in our system, we have sent you an email with instructions to reset your password';

    return esc_html($new);
    
}

本文标签：