retrieve_password( string $user_login = '' ): true|WP_Error

Compatibility

Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.

Parameters

$user_loginstringoptional

Username to send a password retrieval email for.
Defaults to $_POST['user_login'] if not set.Default: ''

Return value

true|WP_Error

True when finished, WP_Error object on error.

Performance profile

How much work a call to retrieve_password() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.

Cost class

Expensive

Sends mail via wp_mail().

Scaling

Constant

No loop in the body: the same number of instructions runs whatever you pass in.

Instructions

41–256

Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 287.

Plugin surface

7 hooks

Third-party callbacks on 'lostpassword_user_data', 'lostpassword_post', 'lostpassword_errors' run inside this call, and their cost is not bounded by anything here.

Called by

1

1 place in core call this, so the cost is paid more often than your own code shows.

What it touches

• querycontent queryget_user_by()called directly
• hookthird-party callbacksapply_filters()called directly
• optionoption read or writeget_option()called directly
• mailsends mailwp_mail()called directly
• cacheobject cachewp_cache_get()one call below retrieve_password()
• serializeserialisationmaybe_unserialize()one call below retrieve_password()

Further down the call graph this can also reach transient. That is the worst case, several calls deep and usually down an error path, not what a normal call pays.

What one call costs · 200 distinct outcomes

One number would be a lie: the work depends on which branch runs. These are every distinct cost retrieve_password() can have, taken from its control-flow graph on PHP 8.5.

Hooks and filters fired · 7

7 hooks fire while retrieve_password() runs, in this order:

1. 1
   apply_filters( lostpassword_user_data )filterline 3281 (+38 into the body)

   Filters the user data during a password reset request.

2. 2
   do_action( lostpassword_post )actionline 3294 (+51 into the body)

   Fires before errors are returned from a password reset request.

3. 3
   apply_filters( lostpassword_errors )filterline 3311 (+68 into the body)

   Filters the errors encountered on a password reset request.

4. 4
   apply_filters( send_retrieve_password_email )filterline 3333 (+90 into the body)

   Filters whether to send the retrieve password email.

5. 5
   apply_filters( retrieve_password_title )filterline 3402 (+159 into the body)

   Filters the subject of the password reset email.

6. 6
   apply_filters( retrieve_password_message )filterline 3417 (+174 into the body)

   Filters the message body of the password reset mail.

7. 7
   apply_filters( retrieve_password_notification_email )filterline 3452 (+209 into the body)

   Filters the contents of the reset password notification email sent to the user.

Uses · 19

• wp_unslash()Removes slashes from a string or recursively removes slashes from strings within an array.
• __()Retrieves the translation of $text.
• get_user_by()Retrieves user info by a given field.
• apply_filters()Calls the callback functions that have been added to a filter hook.
• do_action()Calls the callback functions that have been added to an action hook.
• get_password_reset_key()Creates, stores, then returns a password reset key for user.
• is_wp_error()Checks whether the given variable is a WordPress Error.
• get_user_locale()Retrieves the locale of a user.
• switch_to_user_locale()Switches the translations according to the given user's locale.
• is_multisite()Determines whether Multisite is enabled.
• get_network()Retrieves network data given a network ID or network object.
• wp_specialchars_decode()Converts a number of HTML entities into their special characters.

Used by · 1

• wp_ajax_send_password_reset()Handles sending a password reset link via AJAX.

Source code

View on Trac ↗View on GitHub ↗

3243function retrieve_password( $user_login = '' ) {3244	$errors    = new WP_Error();3245	$user_data = false;3246 3247	// Use the passed $user_login if available, otherwise use $_POST['user_login'].3248	if ( ! $user_login && ! empty( $_POST['user_login'] ) && is_string( $_POST['user_login'] ) ) {3249		$user_login = $_POST['user_login'];3250	}3251 3252	$user_login = trim( wp_unslash( $user_login ) );3253 3254	if ( empty( $user_login ) ) {3255		$errors->add( 'empty_username', __( '<strong>Error:</strong> Please enter a username or email address.' ) );3256	} elseif ( strpos( $user_login, '@' ) ) {3257		$user_data = get_user_by( 'email', $user_login );3258 3259		if ( empty( $user_data ) ) {3260			$user_data = get_user_by( 'login', $user_login );3261		}3262 3263		if ( empty( $user_data ) ) {3264			$errors->add( 'invalid_email', __( '<strong>Error:</strong> There is no account with that username or email address.' ) );3265		}3266	} else {3267		$user_data = get_user_by( 'login', $user_login );3268	}3269 3270	/**3271	 * Filters the user data during a password reset request.3272	 *3273	 * Allows, for example, custom validation using data other than username or email address.3274	 *3275	 * @since 5.7.03276	 *3277	 * @param WP_User|false $user_data WP_User object if found, false if the user does not exist.3278	 * @param WP_Error      $errors    A WP_Error object containing any errors generated3279	 *                                 by using invalid credentials.3280	 */3281	$user_data = apply_filters( 'lostpassword_user_data', $user_data, $errors );3282 3283	/**3284	 * Fires before errors are returned from a password reset request.3285	 *3286	 * @since 2.1.03287	 * @since 4.4.0 Added the `$errors` parameter.3288	 * @since 5.4.0 Added the `$user_data` parameter.3289	 *3290	 * @param WP_Error      $errors    A WP_Error object containing any errors generated3291	 *                                 by using invalid credentials.3292	 * @param WP_User|false $user_data WP_User object if found, false if the user does not exist.3293	 */3294	do_action( 'lostpassword_post', $errors, $user_data );3295 3296	/**3297	 * Filters the errors encountered on a password reset request.3298	 *3299	 * The filtered WP_Error object may, for example, contain errors for an invalid3300	 * username or email address. A WP_Error object should always be returned,3301	 * but may or may not contain errors.3302	 *3303	 * If any errors are present in $errors, this will abort the password reset request.3304	 *3305	 * @since 5.5.03306	 *3307	 * @param WP_Error      $errors    A WP_Error object containing any errors generated3308	 *                                 by using invalid credentials.3309	 * @param WP_User|false $user_data WP_User object if found, false if the user does not exist.3310	 */3311	$errors = apply_filters( 'lostpassword_errors', $errors, $user_data );3312 3313	if ( $errors->has_errors() ) {3314		return $errors;3315	}3316 3317	if ( ! $user_data ) {3318		$errors->add( 'invalidcombo', __( '<strong>Error:</strong> There is no account with that username or email address.' ) );3319		return $errors;3320	}3321 3322	/**

Changelog

Introduced in 2.5.0. Unchanged from 6.7.7 through 7.1.0.

1. 6.7.7
2. 6.8.8
3. 6.9.7
4. 7.0.4
5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data

Generated from the wordpress-develop 7.0.4 tag, from src/wp-includes/user.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.

Corrections

Something wrong on this page? Report it and it gets fixed in the next regeneration.