这是一个多方面的问题，一开始可能看起来（至少对我来说）很容易。不确定代码是否有效，但是，它已接近有效but most importantly, showcases the flow of how things need to happen:
/**
* First of all, hook up to the login process.
*/
add_action( \'wp_login\', function( $user_login, $user ) {
//Let\'s see if the user that just logged in has a proper password, meaning, he reset his default one to a custom one.
$has_proper_password = get_user_meta( $user->ID, \'has_proper_password\', True );
//If he doesn\'t
if( $has_proper_password === \'0\' ) {
//Always redirect him to that password panel.
wp_safe_redirect( wp_login_url( \'?action=lostpassword\' ) );
}
});
因此，首先，您要连接到登录过程。我假设您正在为用户生成一个默认密码并将其邮寄给他们，而您想要更改密码的原因是，如果攻击者访问了发送到的媒体，则纯文本永远无效。回到主题，
the core of this sub-system will be an user_meta with the flag has_proper_password, 您将在此处存储一个标志，告诉我们给定用户是否重置了默认密码。无论何时登录，如果他们没有更改默认密码，他们只会被重定向到您的屏幕。继续。
然后，当用户尝试重置时，您需要获取其当前哈希密码。钩子password_reset 在这之前开火：
//Let\'s store the old password, before the reset happened.
$old_password_hash = \'\';
//We\'ll grab it from the \'password_reset\' hook which fires right before the password is updated.
add_action( \'password_reset\', function( $user, $new_pass ) {
$old_password_hash = $user->user_pass;
});
很好，现在我们有了用户的哈希。让我们假设发生了成功的密码更改。总而言之，你想回到那一点上
user_meta 如果用户的默认密码没有更改，请遵循以下逻辑：
新密码与旧密码相同吗？如果是的话，用一条新消息或类似的东西重定向回更改密码屏幕。如果没有，请继续user_meta 告诉系统，当用户再次登录时，它不应该阻止他并要求提供有效密码，因为密码已经存在所有这些，在代码中：
//Second of all, hook up to the change password process.
add_action( \'after_password_reset\', function( $user, $new_pass ) {
$has_proper_password = get_user_meta( $user->ID, \'has_proper_password\', True );
/**
* If, before this reset happened, the user still didn\'t have a proper password and now
* he supposedly does
*/
if( $has_proper_password === \'0\' ) {
//First of all, is the password that was just updated the same as the one that we gave to them?
if( wp_check_password( $new_pass, $old_password_hash ) === False ) {
//Redirect back to that reset page? I don\'t know.
}
//But if it isn\'t and therefore the newly picked password is a different one, let the system know by attaching some data to the user.
$update = add_user_meta(
$user->ID,
\'has_proper_password\',
\'1\'
);
//If the update failed, no worries, next time the user will just be prompted to reset again, however, this is an issue you\'ll have to solve.
if( $update === False ) {
return;
}
}
});
