Log in with the email address only
Users log in with their email address; user names are no longer accepted. Attackers usually guess user names, not email addresses.
Before you switch it on: Tell your users first that they’ll log in with their email address, then switch it on.
It arrives switched off, even when you install its whole pack with "Switch on after installing".
<?php
remove_filter( 'authenticate', 'wp_authenticate_username_password', 20 );
// Say "Email Address" on the login form.
add_action(
'login_init',
static function () {
add_filter(
'gettext',
static function ( $translation, $text, $domain ) {
if ( 'default' === $domain && 'Username or Email Address' === $text ) {
return __( 'Email Address' );
}
return $translation;
},
10,
3
);
}
);
Good to know
Plugins with their own login forms (WooCommerce’s My account) follow the same rule, so tell your customers to use their email.
In these packs
- Users and profiles: Registration dates, last logins, social profile fields, longer sessions and stricter passwords.
- Login and security extras: Limit login attempts, email-only logins, a registration spam trap and more hardening.