By default, WordPress reveals whether the username or password is incorrect during login. This snippet hides those details and shows a generic error message.
Steps
- Open your WordPress theme
functions.phpfile. - Add the code below at the end of the file.
- Save the file.
- Test a failed login attempt.
Done — login errors will no longer reveal sensitive information
⚠️ This improves security by making it harder for attackers to determine valid usernames.
function custom_login_error_message() {
return 'Invalid login credentials.';
}
add_filter('login_errors', 'custom_login_error_message');
