No password resets by email for administrators
The “Lost your password?” link can’t be used to reset an administrator’s password. If an admin’s mailbox is ever hacked, the site isn’t.
<?php
add_filter(
'allow_password_reset',
static function ( $allow, $user_id ) {
return user_can( $user_id, 'manage_options' ) ? false : $allow;
},
10,
2
);
Good to know
An administrator who forgets their password needs another administrator, WP-CLI (wp user update) or the host to reset it.
In these packs
- Login and security extras: Limit login attempts, email-only logins, a registration spam trap and more hardening.