retrieve_password( string $user_login = '' ): true|WP_Error

Compatibility

Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.

Parameters

$user_loginstringoptional

Username to send a password retrieval email for.
Defaults to $_POST['user_login'] if not set.Default: ''

Return value

true|WP_Error

True when finished, WP_Error object on error.

Performance profile

How much work a call to retrieve_password() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.

Cost class

Expensive

Sends mail via wp_mail().

Scaling

Constant

No loop in the body: the same number of instructions runs whatever you pass in.

Instructions

41–256

Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 287.

Plugin surface

7 hooks

Third-party callbacks on 'lostpassword_user_data', 'lostpassword_post', 'lostpassword_errors' run inside this call, and their cost is not bounded by anything here.

Called by

1

1 place in core call this, so the cost is paid more often than your own code shows.

What it touches

• querycontent queryget_user_by()called directly
• hookthird-party callbacksapply_filters()called directly
• optionoption read or writeget_option()called directly
• mailsends mailwp_mail()called directly
• cacheobject cachewp_cache_get()one call below retrieve_password()
• serializeserialisationmaybe_unserialize()one call below retrieve_password()

Further down the call graph this can also reach transient. That is the worst case, several calls deep and usually down an error path, not what a normal call pays.

What one call costs · 200 distinct outcomes

One number would be a lie: the work depends on which branch runs. These are every distinct cost retrieve_password() can have, taken from its control-flow graph on PHP 8.5.

Hooks and filters fired · 7

7 hooks fire while retrieve_password() runs, in this order:

1. 1
   apply_filters( lostpassword_user_data )filterline 3300 (+38 into the body)

   Filters the user data during a password reset request.

2. 2
   do_action( lostpassword_post )actionline 3313 (+51 into the body)

   Fires before errors are returned from a password reset request.

3. 3
   apply_filters( lostpassword_errors )filterline 3330 (+68 into the body)

   Filters the errors encountered on a password reset request.

4. 4
   apply_filters( send_retrieve_password_email )filterline 3352 (+90 into the body)

   Filters whether to send the retrieve password email.

5. 5
   apply_filters( retrieve_password_title )filterline 3421 (+159 into the body)

   Filters the subject of the password reset email.

6. 6
   apply_filters( retrieve_password_message )filterline 3436 (+174 into the body)

   Filters the message body of the password reset mail.

7. 7
   apply_filters( retrieve_password_notification_email )filterline 3471 (+209 into the body)

   Filters the contents of the reset password notification email sent to the user.

Uses · 19

• wp_unslash()Removes slashes from a string or recursively removes slashes from strings within an array.
• __()Retrieves the translation of $text.
• get_user_by()Retrieves user info by a given field.
• apply_filters()Calls the callback functions that have been added to a filter hook.
• do_action()Calls the callback functions that have been added to an action hook.
• get_password_reset_key()Creates, stores, then returns a password reset key for user.
• is_wp_error()Checks whether the given variable is a WordPress Error.
• get_user_locale()Retrieves the locale of a user.
• switch_to_user_locale()Switches the translations according to the given user's locale.
• is_multisite()Determines whether Multisite is enabled.
• get_network()Retrieves network data given a network ID or network object.
• wp_specialchars_decode()Converts a number of HTML entities into their special characters.

Used by · 1

• wp_ajax_send_password_reset()Handles sending a password reset link via AJAX.

Source code

View on Trac ↗View on GitHub ↗

3262function retrieve_password( $user_login = '' ) {3263	$errors    = new WP_Error();3264	$user_data = false;3265 3266	// Use the passed $user_login if available, otherwise use $_POST['user_login'].3267	if ( ! $user_login && ! empty( $_POST['user_login'] ) && is_string( $_POST['user_login'] ) ) {3268		$user_login = $_POST['user_login'];3269	}3270 3271	$user_login = trim( wp_unslash( $user_login ) );3272 3273	if ( empty( $user_login ) ) {3274		$errors->add( 'empty_username', __( '<strong>Error:</strong> Please enter a username or email address.' ) );3275	} elseif ( strpos( $user_login, '@' ) ) {3276		$user_data = get_user_by( 'email', $user_login );3277 3278		if ( empty( $user_data ) ) {3279			$user_data = get_user_by( 'login', $user_login );3280		}3281 3282		if ( empty( $user_data ) ) {3283			$errors->add( 'invalid_email', __( '<strong>Error:</strong> There is no account with that username or email address.' ) );3284		}3285	} else {3286		$user_data = get_user_by( 'login', $user_login );3287	}3288 3289	/**3290	 * Filters the user data during a password reset request.3291	 *3292	 * Allows, for example, custom validation using data other than username or email address.3293	 *3294	 * @since 5.7.03295	 *3296	 * @param WP_User|false $user_data WP_User object if found, false if the user does not exist.3297	 * @param WP_Error      $errors    A WP_Error object containing any errors generated3298	 *                                 by using invalid credentials.3299	 */3300	$user_data = apply_filters( 'lostpassword_user_data', $user_data, $errors );3301 3302	/**3303	 * Fires before errors are returned from a password reset request.3304	 *3305	 * @since 2.1.03306	 * @since 4.4.0 Added the `$errors` parameter.3307	 * @since 5.4.0 Added the `$user_data` parameter.3308	 *3309	 * @param WP_Error      $errors    A WP_Error object containing any errors generated3310	 *                                 by using invalid credentials.3311	 * @param WP_User|false $user_data WP_User object if found, false if the user does not exist.3312	 */3313	do_action( 'lostpassword_post', $errors, $user_data );3314 3315	/**3316	 * Filters the errors encountered on a password reset request.3317	 *3318	 * The filtered WP_Error object may, for example, contain errors for an invalid3319	 * username or email address. A WP_Error object should always be returned,3320	 * but may or may not contain errors.3321	 *3322	 * If any errors are present in $errors, this will abort the password reset request.3323	 *3324	 * @since 5.5.03325	 *3326	 * @param WP_Error      $errors    A WP_Error object containing any errors generated3327	 *                                 by using invalid credentials.3328	 * @param WP_User|false $user_data WP_User object if found, false if the user does not exist.3329	 */3330	$errors = apply_filters( 'lostpassword_errors', $errors, $user_data );3331 3332	if ( $errors->has_errors() ) {3333		return $errors;3334	}3335 3336	if ( ! $user_data ) {3337		$errors->add( 'invalidcombo', __( '<strong>Error:</strong> There is no account with that username or email address.' ) );3338		return $errors;3339	}3340 3341	/**

Changelog

Introduced in 2.5.0. Unchanged from 6.7.7 through 7.1.0.

1. 6.7.7
2. 6.8.8
3. 6.9.7
4. 7.0.4
5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data

Generated from the wordpress-develop 7.1.0 tag, from src/wp-includes/user.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.

Corrections

Something wrong on this page? Report it and it gets fixed in the next regeneration.