One message for every failed login
The login form says “Wrong username or password” instead of telling a stranger whether a user name exists.
<?php
// Change the message to your own words or language if you like.
add_filter(
'login_errors',
static function ( $error ) {
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Only reads which form this is.
$action = isset( $_REQUEST['action'] ) ? sanitize_key( wp_unslash( $_REQUEST['action'] ) ) : 'login';
if ( 'login' !== $action ) {
return $error; // Lost password and registration keep their messages.
}
return '<strong>' . esc_html__( 'Error:' ) . '</strong> ' . esc_html( 'Wrong username or password.' );
}
);
In these packs
- Harden WordPress: Close the doors attackers try first: XML-RPC, user name discovery, the file editors, revealing login errors.