Customize Login Error Messages to Boost Account Security

By default, WordPress and plugins like Paid Memberships Pro display detailed login error messages such as:

“The password you entered for the username [email protected] is incorrect.”

While helpful for legitimate users, this kind of feedback can unintentionally tip off attackers that a specific username or email exists on your site.

For example, if someone enters an existing email with the wrong password, the error confirms the account is valid, handing useful intel to bots or bad actors.

This code recipe helps you lock that down by replacing all login errors with a single, generic message:

“There was an error with the login details provided. Please try again.”

With this change in place, login feedback becomes neutral, offering no clues about whether the issue was the username, email, or password. It’s a simple but effective way to tighten your site’s security without affecting usability.

How It Works

This code uses the WordPress gettext filter to swap default login error messages with more generic responses. The gettext filter allows you to modify default text across your site without touching the core files.

In this example, we use that gettext filter to replace specific login error messages from WordPress and Paid Memberships Pro.

Instead of showing errors that reveal the presence of a username or email address, we display a single, user-friendly message: “Your login information is incorrect. Please try again.”

This update adds an extra layer of security by not revealing whether the issue is with the username, email, or password.

Screenshots: Before and After

The Code Recipe

Adding the Recipe to Your Website

You can add this recipe to your site by creating a custom plugin or using the Code Snippets plugin available for free in the WordPress repository. Read this companion article for step-by-step directions on either method.

How to Customize This Code Recipe

Update lines 19, 27, 31, and 35 with your preferred custom message. In this example, all error messages are replaced with the generic phrase: “There was an error with the login details provided. Please try again.”