UserProfiles
147 hooks fired by UserProfiles: 106 filters and 41 actions across 168 call sites.
147 hooks fired by UserProfiles: 106 filters and 41 actions across 168 call sites. 143 of the 168 call sites are described by a docblock, at the call or on the constant that names the hook; the rest are listed with their signature and call sites only. Paths are relative to the plugin directory.
authenticate
Filter · 3 arguments · 1 call site
apply_filters( 'authenticate', $allowed, $user->user_login, '' )Fired from:
packages/UserProfiles/SocialLogin/Core/Accounts.php:119
illegal_user_logins
Filter · 1 argument · 1 call site
Filters the list of usernames that may not be registered.
This is WordPress core's own filter, fired here a second time so that a username derived from the submitted email address can be tested before it is handed to wp_insert_user(). It is reached only when the registration form maps no user_login field, since that is the only case in which generateUsername() runs.
A match does not produce an error: both sides are lowercased for the comparison, and a hit makes generateUsername() substitute a random "xp_NNNN" name instead. Core fires the same filter in wp_insert_user() (wp-includes/user.php), so a callback registered for that check already applies here and needs no duplicate.
apply_filters( 'illegal_user_logins', [] )$illegal_logins(array) — Usernames that may not be used. Default empty array. Cast to array on return, so a non-array value is coerced rather than rejected.
Fired from:
packages/UserProfiles/Auth/Modules/Registration/Module.php:110
login_errors
Filter · 1 argument · 2 call sites
apply_filters( 'login_errors', __('<strong>Error:</strong> The username or password you entered is incorrect.', '{XPAC}') )
apply_filters( 'login_errors', $message )Fired from:
packages/UserProfiles/Auth/Modules/Login/Module.php:205packages/UserProfiles/Auth/Modules/Login/Module.php:228
login_redirect
Filter · 3 arguments · 1 call site
apply_filters( 'login_redirect', $target, $requested, $safeUser )Fired from:
packages/UserProfiles/SocialLogin/Core/Accounts.php:164
new_user_email_content
Filter · 2 arguments · 1 call site
apply_filters( 'new_user_email_content', $email_text, $filterData )Fired from:
packages/UserProfiles/Auth/Modules/Update/Module.php:116
$old
Action · Dynamic name · 4 arguments · 2 call sites
Fires before a photo field's files are stored, under the field's old name.
Fires once a photo field's files are dealt with, under the field's old name.
do_action_deprecated( $old, [$block, $upload, $maxSize, $limit], BlockRenames::SINCE, 'xpac_form_pre_' . Avatar::BLOCK . '_upload' )
do_action_deprecated( $old, [$block, $results, $maxSize, $limit], BlockRenames::SINCE, 'xpac_form_post_' . Avatar::BLOCK . '_upload' )$block(array) — Parsed block for the field being uploaded for.$upload(array) — Files about to be stored.$maxSize(int) — Per-file size cap in bytes. 0 for no cap.$limit(int) — Maximum number of files. 0 for no limit.
Fired from:
packages/UserProfiles/Forms/AvatarUploadBlock.php:252packages/UserProfiles/Forms/AvatarUploadBlock.php:290
self::LEGACY_CRON
Action · Dynamic name · 0 arguments · 1 call site
Fires after the daily incomplete-profile reminder ran.
do_action_deprecated( self::LEGACY_CRON, [], LegacyCommunity::SINCE, self::CRON )Fired from:
packages/UserProfiles/Notifications/UserNotifications.php:237
wp_authenticate_user
Filter · 2 arguments · 1 call site
apply_filters( 'wp_authenticate_user', $user, '' )Fired from:
packages/UserProfiles/SocialLogin/Core/Accounts.php:111
wp_login
Action · 2 arguments · 1 call site
do_action( 'wp_login', $allowed->user_login, $allowed )Fired from:
packages/UserProfiles/SocialLogin/Core/Accounts.php:150
xp_cp_avatar_sizes
Filter · 1 argument · 1 call site
Filters the sizes an uploaded profile photo is saved in.
apply_filters_deprecated( 'xp_cp_avatar_sizes', [$sizes], '1.0.0', 'xpac_user_profiles_avatar_sizes' )$sizes(array) — Size name => ['width' => int, 'height' => int, 'crop' => bool].
Fired from:
packages/UserProfiles/Core/Avatar.php:112
xp_cp_block_visibility_privacy_based_values
Filter · 3 arguments · 1 call site
Filters a user's settings before a group's privacy relations are checked against them.
apply_filters_deprecated( 'xp_cp_block_visibility_privacy_based_values', [$values, $ownerId, $relation], LegacyCommunity::SINCE, self::VALUES_FILTER )$values(array<string, array<string, mixed>>) — Each setting with itsvalue, by id.$ownerId(int) — The user.$relation(string) — and or or.
Fired from:
packages/UserProfiles/Core/Privacy.php:460
xp_cp_excluded_users_in_members_query
Filter · 1 argument · 1 call site
Filters the users left out of the directory and the search.
apply_filters_deprecated( self::LEGACY_EXCLUDED_FILTER, [$ids], LegacyCommunity::SINCE, self::EXCLUDED_FILTER )$ids(int[]) — User IDs.
Fired from:
packages/UserProfiles/Core/Directory.php:205
xp_cp_incomplete_profile_notification_threshold
Filter · 1 argument · 1 call site
Filters the profile completion, in percent, below which a user gets the daily reminder.
apply_filters_deprecated( self::LEGACY_THRESHOLD_FILTER, [$threshold], LegacyCommunity::SINCE, self::THRESHOLD_FILTER )$threshold(int|float) — Default 80.
Fired from:
packages/UserProfiles/Notifications/UserNotifications.php:306
xp_cp_members_user_redirect_url_on_protected_page_access
Filter · 1 argument · 1 call site
Filters where a signed-in member goes instead of a protected page.
apply_filters_deprecated( self::LEGACY_REDIRECT_FILTER, [$url], self::SINCE, self::REDIRECT_FILTER )$url(string|null) — Where to send the member.
Fired from:
packages/UserProfiles/Auth/Modules/Access/Module.php:178
xp_cp_render_profile_data
Filter · 3 arguments · 1 call site
Filters whether a profile data block shows a person's answer.
apply_filters_deprecated( 'xp_cp_render_profile_data', [$render, $userId, $key], BlockRenames::SINCE, self::RENDER_FILTER )$render(bool) — Whether to show it.$userId(int) — The person.$key(string) — Field key.
Fired from:
packages/UserProfiles/Blocks/ProfileData.php:157
xp_cp_save_profile_fields
Filter · 2 arguments · 1 call site
Filters the profile answers a form saves.
apply_filters_deprecated( 'xp_cp_save_profile_fields', [$filtered, $original], self::DEPRECATED_SINCE, self::SAVE_FILTER )$values(array) — Field key => value, lists joined with commas, '' when empty.$original(array) — The submitted rows,{slug, name, value}.
Fired from:
packages/UserProfiles/Core/Answers.php:303
xp_cp_user_profile_fields
Filter · 3 arguments · 1 call site
Filters a person's profile answers before they are shown.
apply_filters_deprecated( 'xp_cp_user_profile_fields', [$filtered, $userId, $this], Answers::DEPRECATED_SINCE, self::FIELDS_FILTER )$fields(array) — Field key => value, the account's own values included.$userId(int) — The person.$profiles(Profiles) — This object.
Fired from:
packages/UserProfiles/Core/Profiles.php:612
xpac-cp-member-query-filter-by
Filter · 1 argument · 1 call site
applyFilters( 'xpac-cp-member-query-filter-by', options )Fired from:
assets/packages/user-profiles/blocks/users-query/filter-options.js:24
xpac_agent_changed
Action · 4 arguments · 7 call sites
Fires when an agent's tool call is about to change something XPAC Agent cannot record by itself.
Here a member's profile answers, which update-member-answers
changes. Agent keeps the report only while one of its tool calls
runs, and asks User Profiles to put the answers back through
xpac_agent_undo.
Fires when an agent's tool call is about to change something XPAC Agent cannot record by itself.
Here whether a user is suspended, which suspend-member changes.
Agent keeps the report only while one of its tool calls runs, and
asks User Profiles to set it back through xpac_agent_undo.
Fires when a tool call changed something XPAC Agent cannot record by itself.
User Profiles fires it before a tool changes or deletes a field set,
and after one makes a set, since a set is a term Agent does not
record. Agent keeps it only while one of its tool calls is running,
and asks User Profiles to put the set back through xpac_agent_undo.
Outside a call, or while Agent is not active, nothing hears it.
Fires when an agent's tool call is about to change something XPAC Agent does not record by itself.
Here the form each kind uses on User Profiles › Forms and pages, which
make-auth-form, set-auth-action and build-auth-pages change when
they set a kind up. Agent keeps the report only while one of its
tool calls runs, and asks User Auth to put the choice back through
xpac_agent_undo.
Fires when an agent's tool call is about to change something XPAC Agent does not record by itself.
Here the sign-in settings update-auth-settings and
build-auth-pages write, and that setting a kind up on User
Profiles › Forms and pages writes: the five page settings, the
email verification toggle, the profile and search pages,
Public Profiles and the Access settings of User Profiles' settings,
users_can_register and default_role. Agent
keeps the report only while one of its tool calls runs, and asks
User Auth to put the slice back through xpac_agent_undo.
Fires when an agent's tool call is about to change something XPAC Agent does not record by itself.
Here the Social Login settings update-social-login-settings
changes. Agent keeps the report only while one of its tool calls
runs, and asks Social Login to put the settings back through
xpac_agent_undo.
Fires when an agent's tool call is about to change something XPAC Agent does not record by itself.
Here the sign-up data update-sign-up-data changes: the profile map
and the extra permissions. Agent keeps the report only while one of
its tool calls runs, and asks Social Login to put both back through
xpac_agent_undo.
do_action( 'xpac_agent_changed', self::HANDLER, self::OBJECT_PREFIX . (int) $user->ID, ['user_id' => (int) $user->ID, 'values' => self::values((int) $user->ID, $keys)], sprintf( __('Profile of "%s"', '{XPAC}'), '' !== $name ? $name : (string) $user->user_login ) )
do_action( 'xpac_agent_changed', self::HANDLER, self::OBJECT_PREFIX . (int) $user->ID, ['user_id' => (int) $user->ID, 'suspended' => $suspended], sprintf( __('Suspension of "%s"', '{XPAC}'), '' !== $name ? $name : (string) $user->user_login ) )
do_action( 'xpac_agent_changed', self::HANDLER, 'xpac-user-profiles/set:' . $id, $before, sprintf( __('Field set "%s"', '{XPAC}'), $name ) )
do_action( 'xpac_agent_changed', self::HANDLER, self::OBJECT, AccountForms::snapshot(), self::label() )
do_action( 'xpac_agent_changed', self::HANDLER, self::OBJECT, self::snapshot(), self::label() )
do_action( 'xpac_agent_changed', self::HANDLER, self::OBJECT, ['values' => self::stored($keys)], self::label() )$handler(string) —xpac-user-profiles/answers.$object(string) —xpac-user-profiles/member:<user id>.$before(array) —{user_id, values: {key: value|null}}, the changed keys only.$label(string) — 'Profile of "<name>"'.
Fired from:
packages/UserProfiles/Agent/MemberUndo.php:58packages/UserProfiles/Agent/SuspensionUndo.php:57packages/UserProfiles/Agent/Undo.php:192packages/UserProfiles/Auth/Agent/AccountFormsUndo.php:63packages/UserProfiles/Auth/Agent/SiteSettings.php:713packages/UserProfiles/SocialLogin/Agent/SettingsUndo.php:92packages/UserProfiles/SocialLogin/Agent/SignUpData.php:218
xpac_agent_tool_enabled
Filter · 2 arguments · 3 call sites
Filters whether one XPAC tool may register as an ability.
XPAC Agent answers from its switches under XPAC → AI Agent → Tools, bound at priority 1. While the XPAC Agent plugin is inactive nothing answers, and the default leaves every User Profiles ability unregistered.
Filters whether one XPAC tool may register as an ability.
XPAC Agent answers from its switches under XPAC → AI Agent → Tools, bound at priority 1. While the XPAC Agent plugin is inactive nothing answers, and the default leaves every Login ability unregistered.
Filters whether one XPAC tool may register as an ability.
XPAC Agent answers from its switches under XPAC → AI Agent → Tools, bound at priority 1. While the XPAC Agent plugin is inactive nothing answers, and the default leaves every Social Login ability unregistered.
apply_filters( 'xpac_agent_tool_enabled', false, self::NAMESPACE . '/' . $name )$enabled(bool) — Default false.$name(string) — The full ability name, such asxpac-user-profiles/list-profile-fields.
Fired from:
packages/UserProfiles/Agent/Abilities.php:175packages/UserProfiles/Auth/Agent/Abilities.php:170packages/UserProfiles/SocialLogin/Agent/Abilities.php:149
xpac_autocomplete_search_get_query_var
Filter · 1 argument · 1 call site
apply_filters( 'xpac_autocomplete_search_get_query_var', 's' )Fired from:
packages/UserProfiles/Blocks/UsersQuery.php:495
xpac_community_platform_profile_field_saved
Action · 3 arguments · 1 call site
Fires after a person's profile answer is saved or cleared, whoever saved it.
do_action_deprecated( 'xpac_community_platform_profile_field_saved', [$userId, $key, (string) $value], self::DEPRECATED_SINCE, self::FIELD_SAVED )$userId(int) — The person.$name(string) — Field key.$value(string) — The value saved, '' when cleared.
Fired from:
packages/UserProfiles/Core/Answers.php:417
xpac_cp_allow_admin_access
Filter · 2 arguments · 1 call site
Filters whether a member may open this admin request.
apply_filters_deprecated( self::LEGACY_FILTER, [$allowed, $user], self::SINCE, self::FILTER )$allowed(bool) — Whether this admin request is let through.$user(WP_User) — The member.
Fired from:
packages/UserProfiles/Auth/Core/AdminAccess.php:199
xpac_cp_members_excluded_dynamic_vars
Filter · 1 argument · 1 call site
Filters the {{name}} variables a paragraph leaves for something else to fill.
apply_filters_deprecated( 'xpac_cp_members_excluded_dynamic_vars', [$excluded], Answers::DEPRECATED_SINCE, self::EXCLUDED_FILTER )$names(string[]) — Variable names, as written between the braces.
Fired from:
packages/UserProfiles/Core/DynamicVariables.php:103
xpac_cp_members_query_loop_args
Filter · 3 arguments · 1 call site
Filters the directory's user query, built from a Users Query block's attributes.
apply_filters_deprecated( self::LEGACY_QUERY_ARGS_FILTER, [$queryArgs, $attributes, true], LegacyCommunity::SINCE, self::QUERY_ARGS_FILTER )$queryArgs(array<string, mixed>) — WP_User_Query arguments.$attributes(array<string, mixed>) — The sanitized block attributes.$front(bool) — Whether the query is for the site's pages.
Fired from:
packages/UserProfiles/Core/Directory.php:174
xpac_forms_user_auth_account_verification_for_users
Filter · 1 argument · 1 call site
Filters whether a signed-in visitor may use the account-verification flow.
All three of this module's guards read the same answer. The page guard in getPagesConfig() redirects a signed-in visitor to home_url() when it is false, handlePageRequest() answers the same page with a 404 instead, and execute() returns null so a resend-verification submission silently does nothing and reports success. The default is false, so the verification page and resend form are closed to other signed-in members. A user whose own pending token is in the request is allowed before this filter, and registration never auto-signs in a verification-required account.
Site managers never reach the filter: current_user_can('manage_options') returns true two lines earlier. User Profiles' Access\MemberOnly opens the flow to every signed-in user while open_verification_to_members is on; while that setting is unset it follows verified_account_for_member_only_pages.
apply_filters( 'xpac_forms_user_auth_account_verification_for_users', false )$accessible(bool) — Whether the flow is open to the signed-in visitor. Always false at this call site. There is no way to open one guard and not the others — a truthy return opens all three.
Fired from:
packages/UserProfiles/Auth/Modules/AccountVerification/Module.php:217
xpac_forms_user_auth_account_verified
Action · 1 argument · 1 call site
do_action( 'xpac_forms_user_auth_account_verified', $signup->user_id )Fired from:
packages/UserProfiles/Auth/Modules/AccountVerification/Module.php:343
xpac_forms_user_auth_activation
Action · 0 arguments · 1 call site
Fires once when the User Auth plugin is activated, after the framework's own activation work has finished.
This is the package's install hook and the only point at which schema work is safe, because it runs exactly once per activation rather than on every request. AccountVerification\Database listens here to CREATE the xp_signups table, and Modules\Bootstrap listens to build its module set so the other components exist while the table is being created.
A listener must not assume it was registered before the action ran. Database's constructor guards with doing_action() for this hook and creates the table inline instead, because on the activation request the object can be built after the action has already fired.
No arguments are passed.
do_action( 'xpac_forms_user_auth_activation' )Fired from:
packages/UserProfiles/Auth/Module.php:40
xpac_forms_user_auth_activation_email_failed
Action · 2 arguments · 1 call site
do_action( 'xpac_forms_user_auth_activation_email_failed', $userId, $error )Fired from:
packages/UserProfiles/Auth/Modules/Registration/Module.php:508
xpac_forms_user_auth_allow_registration
Filter · 2 arguments · 1 call site
Filters whether a registration form may create an account.
Defaults to WordPress's own Settings → General → "Anyone can register". Return true to keep an invite-only flow working with that option off.
apply_filters( 'xpac_forms_user_auth_allow_registration', (bool) get_option('users_can_register'), Helper::submissionForExternalCallback($submission) )$allowed(bool) — Whether registration is open.$submission(Submission) — A callback-safe clone without credential answers.
Fired from:
packages/UserProfiles/Auth/Modules/Registration/Module.php:153
xpac_forms_user_auth_can_grant_role
Filter · 3 arguments · 1 call site
Filter whether a user may grant a role through a User Auth form action.
apply_filters( 'xpac_forms_user_auth_can_grant_role', $canPromote && [] === array_diff_key($granted, $held), $userId, $role )$canGrant(bool) — Whether the user may promote accounts and holds every capability of the target role.$userId(int) — User doing the granting.$role(string) — Role slug.
Fired from:
packages/UserProfiles/Auth/Core/Roles.php:105
xpac_forms_user_auth_email_change_confirmation_url
Filter · 1 argument · 1 call site
apply_filters( 'xpac_forms_user_auth_email_change_confirmation_url', $fallbackUrl )Fired from:
packages/UserProfiles/Auth/Modules/Update/Module.php:122
xpac_forms_user_auth_email_change_lifetime
Filter · 1 argument · 1 call site
apply_filters( 'xpac_forms_user_auth_email_change_lifetime', DAY_IN_SECONDS )Fired from:
packages/UserProfiles/Auth/Modules/Update/Module.php:177
xpac_forms_user_auth_email_update_confirmed
Action · 1 argument · 1 call site
do_action( 'xpac_forms_user_auth_email_update_confirmed', Helper::userForExternalCallback($user) )Fired from:
packages/UserProfiles/Auth/Modules/Update/Module.php:233
xpac_forms_user_auth_enforce_verification
Filter · 1 argument · 1 call site
Filters whether an unverified account is refused everywhere, not just on a form whose "verified account only" toggle is on.
Login\Module attaches the same guard around its own wp_signon() call and removes it immediately afterwards, so it covered neither wp-login.php, nor XML-RPC, nor application passwords, nor a second form with the toggle off. Only accounts holding an unactivated signup row are affected, so accounts that never entered the verification flow — including every account that predates it — sign in unchanged.
apply_filters( 'xpac_forms_user_auth_enforce_verification', true )$enforce(bool) — Whether to refuse unverified accounts site-wide.
Fired from:
packages/UserProfiles/Auth/Modules/AccountVerification/Module.php:84
xpac_forms_user_auth_forgot_password_fail
Action · 3 arguments · 1 call site
Fires when a forgot-password submission names an address with no account.
This is the lookup failure, before any mail is attempted: get_user_by('email') found nothing, so $user is always false here. That is what separates this hook from xpac_forms_user_auth_user_forgot_password_fail, which fires when the account does exist but retrieve_password() refused. execute() returns a WP_Error immediately afterwards, which aborts the submission at the pre-submit stage, so no entry row is written and no notification is sent.
do_action( 'xpac_forms_user_auth_forgot_password_fail', $user, Helper::userDataForExternalCallback($userData), Helper::submissionForExternalCallback($submission) )$user(false) — Always false — the failed result of the get_user_by('email') lookup.$userData(array) — The mapped non-credential user fields. Only user_email is read here.$submission(Submission) — A callback-safe clone without credential answers.
Fired from:
packages/UserProfiles/Auth/Modules/ForgotPassword/Module.php:85
xpac_forms_user_auth_form_settings
Filter · 2 arguments · 1 call site
Filters the list of user-auth actions a submission is about to run.
This is resolved while Forms discovers applicable pre-submit mutations and again immediately before User Auth executes. Returning an empty array cancels every auth action for that submission without changing the editor setting.
A missing status deliberately defaults to enabled for legacy/imported items. Unsupported actions and items without userFields are ignored later. More than one runnable action fails closed before any module executes.
Profile-field blocks are not mapped here: User Profiles, which owns the block, reports the account fields they fill through xpac_forms_user_auth_profile_fields. An item with nothing mapped runs from those blocks alone, and a form with profile-field blocks and no item at all, sent by a signed-in member, runs as an update of that member's profile.
apply_filters( 'xpac_forms_user_auth_form_settings', $storedItems, $submission->forExternalCallback() )$items(array) — The form's saved User Auth action items.$submission(Submission) — A callback-safe clone without credential answers.
Fired from:
packages/UserProfiles/Auth/Modules/Bootstrap.php:625
xpac_forms_user_auth_login_after_register
Filter · 3 arguments · 1 call site
Filters whether a registration form signs the new account in.
Defaults to the action's "log in after registration" toggle. An account that still has to confirm its email address is never signed in, whatever this returns. Social Login answers true for a provider sign-up through the form.
apply_filters( 'xpac_forms_user_auth_login_after_register', true === ($config['loginAfterRegister'] ?? false), $userId, Helper::submissionForExternalCallback($submission) )$logIn(bool) — Whether to sign the account in. Default the form's toggle.$userId(int) — ID of the account just created.$submission(Submission) — A callback-safe clone whose password and confirmation answers have been removed.
Fired from:
packages/UserProfiles/Auth/Modules/Registration/Module.php:334
xpac_forms_user_auth_profile_fields
Filter · 2 arguments · 1 call site
Filters what a form's profile-field blocks give User Auth.
Answered by the plugin that owns the profile-field block. Only blocks the visitor saw are reported. An item with nothing mapped takes its account fields from these rows; on a mapped item a reported Email Address, First Name, Last Name or Nickname replaces the mapped row of the same key on the registration and update actions, and any other row is added only when no mapped row of its key gives a value. A form with reported blocks runs its registration and update actions even when nothing is mapped.
apply_filters( 'xpac_forms_user_auth_profile_fields', ['fields' => [], 'blocks' => [], 'credentials' => []], $submission->forExternalCallback() )$answer(array) —fields:{key, value}rows, where key is an account field other than a password, such as user_email or first_name, and value the block's name, for a block whose answer was submitted;credentials:{key, value}rows whose key is user_pass, for a password block the visitor saw;blocks: the names of the form's profile-field blocks.$submission(Submission) — A callback-safe clone without credential answers.
Fired from:
packages/UserProfiles/Auth/Modules/Bootstrap.php:692
xpac_forms_user_auth_redirect_url
Filter · 3 arguments · 3 call sites
Filters where a visitor is sent after signing in through a form.
Consulted only as the last fallback. A _wp_http_referer field on
the submission wins outright, and the form's own redirect
settings win next, so this runs only when neither is set. The
?: on the call replaces any falsy return with home_url(), so
returning null keeps the default rather than disabling the
redirect.
The registration module fires the same filter with $action set to "new_user"; there a falsy return leaves the form's redirect config untouched instead of substituting home_url(), so the two call sites do not behave alike on a null.
The account page answers here for the "login" action, when one is set.
Filters where a visitor is sent after registering through a form.
Consulted only when the form's own redirect settings are off or have no success URL, and only a truthy return is used — unlike the login call site, a falsy return here leaves the form's redirect config exactly as it was rather than substituting home_url().
The closure holding this call is registered on xpac_forms_redirect_config and therefore runs after execute() has returned, which is what decides the third argument: if "log in after registration" was on, it is the new account, and if it was off it is the anonymous WP_User with ID 0. A listener that builds a per-member URL must check the ID rather than trust it.
The account page answers only the "login" action, so it does not affect this call site.
apply_filters( 'xpac_forms_user_auth_redirect_url', null, 'login', Helper::userForExternalCallback($user) )
apply_filters( 'xpac_forms_user_auth_redirect_url', null, 'new_user', Helper::userForExternalCallback(wp_get_current_user()) )
apply_filters( 'xpac_forms_user_auth_redirect_url', null, 'login', $safeUser )$url(string|null) — Proposed target. Always null here.$action(string) — Which auth action is redirecting. Always "login" at this call site.$user(WP_User) — A callback-safe clone of the user who just signed in.
Fired from:
packages/UserProfiles/Auth/Modules/Login/Module.php:306packages/UserProfiles/Auth/Modules/Registration/Module.php:399packages/UserProfiles/SocialLogin/Core/Accounts.php:161
xpac_forms_user_auth_referer
Filter · 1 argument · 1 call site
Filters the value printed into a login form's _wp_http_referer hidden field.
insertHiddenFields() runs on xpac_forms_after_form_begin for every rendered form that carries a login action, and prints the returned value immediately below as a hidden input named _wp_http_referer. By default that is the page the visitor was sent here from: the request's redirect_to, as WordPress's login links carry it.
The return is treated as untrusted at both sinks: insertHiddenFields() applies wp_validate_redirect() and esc_attr(), and Login\Module::execute() validates the submitted value again before returning it to the browser. An off-host or malformed value is ignored in favour of the form's normal redirect settings.
apply_filters( 'xpac_forms_user_auth_referer', $this->requestedRedirect() )$referer(string|null) — URL to submit as the post-login redirect target. The request's own redirect_to when wp_validate_redirect() accepts it, otherwise null. Any falsy return prints no field at all, which leaves the form's own redirect settings in charge of where the visitor lands.
Fired from:
packages/UserProfiles/Auth/Modules/Bootstrap.php:1076
xpac_forms_user_auth_require_verification
Filter · 3 arguments · 1 call site
Filters whether an account a registration form just created must confirm its email address.
Asked only while email verification is on for the site. Return false to leave this one account confirmed from the start: no confirmation marker is written, no activation email is sent, and "log in after registration" may sign the visitor in. Social Login answers false for an address the provider verified while its "Skip email verification for social sign-ups" switch is on.
apply_filters( 'xpac_forms_user_auth_require_verification', true, $userId, Helper::submissionForExternalCallback($submission) )$required(bool) — Whether the account must confirm its address. Default true.$userId(int) — ID of the account just created.$submission(Submission) — A callback-safe clone whose password and confirmation answers have been removed.
Fired from:
packages/UserProfiles/Auth/Modules/Registration/Module.php:298
xpac_forms_user_auth_reset_password_page_slug
Filter · 1 argument · 1 call site
Filters the page slug that stands in for wp-login.php in the password-reset flow.
Read on two separate paths. handlePageRequest() runs on every front-end request, and an empty slug makes it return early — so with no slug the reset page is never 404ed for a visitor with no reset in progress and the wp-resetpass cookie is never set from a ?key=&login= link, which is what makes the form work at all. routeLinks() reads it to move the link in the outgoing reset mail.
Left as it is, the slug only says a page is chosen: the mail links to that page's own address, wherever the page sits, and the request is matched by the page's id. A changed slug is used as given: it replaces the literal "wp-login.php" in the mail's link and is passed to is_page(), so it has to be a bare slug. A path such as "account/reset" survives into the mail but will not satisfy is_page(), which compares against post_name alone.
The unfiltered value is the post_name of the page chosen in the Reset password page setting, or an empty string when no page has been chosen.
apply_filters( 'xpac_forms_user_auth_reset_password_page_slug', $slug )$slug(string) — Page slug with no leading or trailing slash. Empty when the setting is unset or points at a deleted page. Returning a slug with no matching page produces reset mail pointing at a 404.
Fired from:
packages/UserProfiles/Auth/Modules/ResetPassword/Module.php:57
xpac_forms_user_auth_reveal_accounts
Filter · 1 argument · 1 call site
Filters whether User Auth may confirm an account exists.
apply_filters( 'xpac_forms_user_auth_reveal_accounts', false )$reveal(bool) — Whether to answer differently for a known address.
Fired from:
packages/UserProfiles/Auth/Core/Helper.php:150
xpac_forms_user_auth_send_new_user_notifications
Filter · 1 argument · 1 call site
apply_filters( 'xpac_forms_user_auth_send_new_user_notifications', true )Fired from:
packages/UserProfiles/Auth/Modules/Registration/Module.php:316
xpac_forms_user_auth_token_lifetime
Filter · 1 argument · 1 call site
apply_filters( 'xpac_forms_user_auth_token_lifetime', 2 * DAY_IN_SECONDS )Fired from:
packages/UserProfiles/Auth/Modules/AccountVerification/Module.php:294
xpac_forms_user_auth_user_create_fail
Action · 3 arguments · 1 call site
Fires when a registration action's wp_insert_user() call fails.
The codes are core's, most often existing_user_login, existing_user_email or empty_user_login. No account row exists. Duplicate-account failures become the same accepted public response as registration when account disclosure is disabled; this trusted hook still receives core's diagnostic WP_Error.
do_action( 'xpac_forms_user_auth_user_create_fail', $userId, Helper::userDataForExternalCallback($userData), Helper::submissionForExternalCallback($submission) )$userId(WP_Error) — The failure wp_insert_user() returned. Named $userId because it holds the return value of the call that would otherwise be a user ID.$userData(array) — The rejected $userdata array with credentials removed; mapped meta remains under meta_input.$submission(Submission) — A callback-safe clone whose password and confirmation answers have been removed.
Fired from:
packages/UserProfiles/Auth/Modules/Registration/Module.php:224
xpac_forms_user_auth_user_created
Action · 3 arguments · 1 call site
Fires immediately after a registration action has created the account.
The user row is already committed and cannot be rolled back, but nothing else has happened yet: the activation email has not been sent, core's new-user notifications have not been sent, and auto-login has not run. A listener that needs the account to be usable — profile fields, group membership — belongs here. Later activation-mail failure is reported as accepted-with-warning and leaves a recoverable pending account rather than turning this committed write into failure.
User Profiles' Notifications\UserNotifications::sendWelcomeNotification(), which runs while XPAC: Notifications does, takes all three and, when the form had the user choose a password and the welcome email went out, holds core's own new-user mail back for this sign-up by returning false once from xpac_forms_user_auth_send_new_user_notifications. User Profiles' Forms\ProfileFieldSubmission::save() takes all three and writes the submitted profile fields against the new account.
do_action( 'xpac_forms_user_auth_user_created', $userId, Helper::userDataForExternalCallback($userData), Helper::submissionForExternalCallback($submission) )$userId(int) — ID of the account just created.$userData(array) — The committed $userdata array with credentials removed; mapped user meta remains under meta_input.$submission(Submission) — A callback-safe clone whose password and confirmation answers have been removed.
Fired from:
packages/UserProfiles/Auth/Modules/Registration/Module.php:273
xpac_forms_user_auth_user_forgot_password
Action · 3 arguments · 1 call site
Fires after a password reset link has been mailed successfully.
retrieve_password() has already generated the key, stored its hash in the account's user_activation_key and sent the mail, with the link pointed at the configured Reset password page by changeResetPasswordLink(). Nothing after this point can fail the submission, so a listener may treat the reset as issued.
Forms stores the accepted submission afterwards. It may retain the submitted address according to the form's normal entry settings; credential answers are always removed before that boundary.
do_action( 'xpac_forms_user_auth_user_forgot_password', Helper::userForExternalCallback($user), Helper::userDataForExternalCallback($userData), Helper::submissionForExternalCallback($submission) )$user(WP_User) — A clone of the account with its password hash and reset-key material blanked.$userData(array) — The mapped non-credential user fields.$submission(Submission) — A callback-safe clone without credential answers.
Fired from:
packages/UserProfiles/Auth/Modules/ForgotPassword/Module.php:156
xpac_forms_user_auth_user_forgot_password_fail
Action · 3 arguments · 1 call site
Fires when the account exists but WordPress could not issue a reset link.
retrieve_password() returned a WP_Error: the site blocked the reset through allow_password_reset, no reset key could be stored, or wp_mail() refused the message. Contrast xpac_forms_user_auth_forgot_password_fail, which fires when no account matched at all. The same WP_Error is returned to the visitor as the submission result, so the submission aborts and nothing is logged.
do_action( 'xpac_forms_user_auth_user_forgot_password_fail', $errors, Helper::userDataForExternalCallback($userData), Helper::submissionForExternalCallback($submission) )$errors(WP_Error) — The error retrieve_password() returned. Its code is core's, commonly retrieve_password_email_failure or no_password_reset.$userData(array) — The mapped non-credential user fields.$submission(Submission) — A callback-safe clone without credential answers.
Fired from:
packages/UserProfiles/Auth/Modules/ForgotPassword/Module.php:130
xpac_forms_user_auth_user_logged_in
Action · 3 arguments · 2 call sites
Fires after a login action has authenticated the visitor.
wp_signon() has already set the auth cookie and the current user, so is_user_logged_in() is true here and wp_get_current_user() returns $user.
The registration module fires this same hook name when "log in after registration" is on (Registration/Module.php), so a listener sees both paths and must not assume the account already existed. Fires before this module attaches its xpac_forms_redirect_config callback. Forms stores the accepted submission afterwards with all credential answers removed.
Fires after a new registrant has been signed in automatically.
Reached only when the action's "log in after registration" toggle is on. The previous session has been cleared and wp_set_current_user() plus wp_set_auth_cookie() have already run, so the new account is the current user.
This is the same hook name the login module fires, so a listener sees both a returning member and a brand-new account and must not assume either. The registration path reaches it only when verification is not required; pending accounts are deliberately never auto-signed in.
do_action( 'xpac_forms_user_auth_user_logged_in', Helper::userForExternalCallback($user), Helper::userDataForExternalCallback($userData), Helper::submissionForExternalCallback($submission) )
do_action( 'xpac_forms_user_auth_user_logged_in', Helper::userForExternalCallback(get_user_by('id', $userId)), Helper::userDataForExternalCallback($userData), Helper::submissionForExternalCallback($submission) )$user(WP_User) — A clone of the now-authenticated user with password hash and reset-key material blanked.$userData(array) — The action's mapped user fields with user_pass and user_current_pass deliberately removed.$submission(Submission) — A callback-safe clone whose password and confirmation answers have been removed.
Fired from:
packages/UserProfiles/Auth/Modules/Login/Module.php:254packages/UserProfiles/Auth/Modules/Registration/Module.php:365
xpac_forms_user_auth_user_login_fail
Action · 3 arguments · 1 call site
Fires when a login action's wp_signon() call fails.
The codes reachable here are core's empty_username, empty_password, invalid_username, invalid_email and incorrect_password, plus this package's own unverified_account when the form has "verified account only" on and account verification is enabled. Fires before execute() normalizes an invalid-account error, so the code and message seen here are exactly the ones wp_signon() produced.
do_action( 'xpac_forms_user_auth_user_login_fail', $user, Helper::userDataForExternalCallback($userData), Helper::submissionForExternalCallback($submission) )$user(WP_Error) — The authentication failure wp_signon() returned.$userData(array) — The action's mapped user fields with user_pass and user_current_pass deliberately removed.$submission(Submission) — A callback-safe clone whose password and confirmation answers have been removed.
Fired from:
packages/UserProfiles/Auth/Modules/Login/Module.php:164
xpac_forms_user_auth_user_reset_password
Action · 3 arguments · 2 call sites
Fires after a password change has been accepted.
The forgotPassword flow reaches this call only after wp_update_user() has committed the new password and the reset cookie has been cleared. Update\Module fires the same hook after a current-password-authenticated profile change has committed, so listeners may treat either call site as a durable password-change boundary.
Forms stores the accepted submission afterwards with all password and confirmation answers removed.
do_action( 'xpac_forms_user_auth_user_reset_password', Helper::userForExternalCallback($user), Helper::userDataForExternalCallback($userData), Helper::submissionForExternalCallback($submission) )$user(WP_User) — A callback-safe clone of the reset key's owner.$userData(array) — The action's mapped user fields with both password values removed.$submission(Submission) — A callback-safe clone whose password and confirmation answers have been removed.
Fired from:
packages/UserProfiles/Auth/Modules/ResetPassword/Module.php:389packages/UserProfiles/Auth/Modules/Update/Module.php:468
xpac_forms_user_auth_user_reset_password_fail
Action · 3 arguments · 1 call site
Fires when the password write of a forgot-password reset fails.
wp_update_user() returned a WP_Error. The reset key and the new password had already passed every check this module makes, so the failure is core's or another plugin's, and the account still holds its old password. The same WP_Error is returned as the submission result, which aborts the submission at the pre-submit stage — no entry row is written and no notification is sent. The error object itself is not passed to listeners.
The wp-resetpass cookie is deliberately retained on failure so the visitor may correct a transient write problem without requesting a fresh email.
do_action( 'xpac_forms_user_auth_user_reset_password_fail', Helper::userForExternalCallback($user), Helper::userDataForExternalCallback($userData), Helper::submissionForExternalCallback($submission) )$user(WP_User) — The account whose password could not be written, resolved from the reset key by check_password_reset_key().$userData(array) — The action's mapped user fields with both password values removed.$submission(Submission) — A callback-safe clone whose password and confirmation answers have been removed.
Fired from:
packages/UserProfiles/Auth/Modules/ResetPassword/Module.php:358
xpac_forms_user_auth_user_update_fail
Action · 3 arguments · 2 call sites
Fires when an update action's wp_update_user() call fails.
The codes are core's, most often existing_user_email or invalid_user_email. Nothing has been written to the account, and the WP_Error is returned to the visitor as the submission result, so the submission aborts.
The reset-password module fires this same hook name when its own wp_update_user() call fails, so a listener must not assume the update action.
do_action( 'xpac_forms_user_auth_user_update_fail', $error, Helper::userDataForExternalCallback($userData), Helper::submissionForExternalCallback($submission) )
do_action( 'xpac_forms_user_auth_user_update_fail', $userId, Helper::userDataForExternalCallback($userData), Helper::submissionForExternalCallback($submission) )$userId(WP_Error) — The failure wp_update_user() returned. Named $userId because it holds the return value of the call that would otherwise be a user ID.$userData(array) — The rejected $userdata array with credentials removed. It is already reduced: empty values have been stripped by array_filter, ID is the signed-in user, mapped meta sits under meta_input, user_email is absent when the action confirms email changes, and user_current_pass is absent when it confirms password changes.$submission(Submission) — A callback-safe clone whose password and confirmation answers have been removed.
Fired from:
packages/UserProfiles/Auth/Modules/ResetPassword/Module.php:277packages/UserProfiles/Auth/Modules/Update/Module.php:433
xpac_forms_user_auth_user_updated
Action · 3 arguments · 1 call site
Fires after an update action has saved changes to the signed-in user's account.
wp_update_user() has already committed the profile fields, the password and — when the action does not confirm email changes — the new address. Any confirmation mail has been queued by this point, so a pending address change is not yet reflected in the account and will only appear once the member follows the link.
User Profiles' Forms\ProfileFieldSubmission::save() listens here as it does on xpac_forms_user_auth_user_created, and writes the form's profile fields.
do_action( 'xpac_forms_user_auth_user_updated', $userId, Helper::userDataForExternalCallback($userData), Helper::submissionForExternalCallback($submission) )$userId(int) — ID of the updated account, which is always the currently signed-in user.$userData(array) — The applied $userdata array with credentials removed, after array_filter stripped empty values. user_email is absent when the action confirms email changes, so its presence here does not mean the address changed.$submission(Submission) — A callback-safe clone whose password and confirmation answers have been removed.
Fired from:
packages/UserProfiles/Auth/Modules/Update/Module.php:497
xpac_social_login_abilities
Filter · 1 argument · 1 call site
Filters which Social Login abilities are registered for AI agents.
Asked whenever Social Login reads which of its tools are on: when the
Abilities API registers abilities and when Agent builds its
instructions. Names are the part after xpac-social-login/, such as
add-sign-in-buttons. One left out is not registered at all, so no REST
route, MCP server or WordPress AI feature can call it. The default is
what XPAC Agent's switches allow, which is none while Agent is off or
absent. One added here is registered for the Abilities API and
WordPress's AI features, but Agent's chat and MCP server still offer
only what its switches allow.
apply_filters( 'xpac_social_login_abilities', $allowed )$abilities(string[]) — Ability names. Default the ones XPAC Agent's switches allow.
Fired from:
packages/UserProfiles/SocialLogin/Agent/Abilities.php:169
xpac_social_login_form_identity
Filter · 4 arguments · 1 call site
Filters the profile data a provider sign-up writes into a form.
Runs while a sign-up form is submitted with a valid provider pass, before Conditional Logic and validation, and once before that, when the provider's window reports back, to tell the page which fields the sign-up fills. The provider's first and last name are used when it sends them; otherwise its full name is split at the first space. Every value but the email is read back: the email is always the provider's verified address. A value set for a claim the provider did not send fills its field all the same, and an empty one leaves the field to the visitor.
apply_filters( 'xpac_social_login_form_identity', $values, Accounts::publicIdentity($pass), (string) ($pass['provider'] ?? ''), $formId )$values(array<string, string>) —email,first_name,last_name,username,localeandprofile_url, then every other claim the profile map places, such ascompanyorphone, as they will be written. Yes-or-no claims readyesorno, lists one item per line.$identity(array<string, mixed>) — The provider's public profile: subject, email, email_verified, name, first_name, last_name, username, avatar_url, locale, profile_url, then the other claims the profile map places.$provider(string) — Provider ID, such as google.$formId(int) — The form being filled.
Fired from:
packages/UserProfiles/SocialLogin/Integrations/Forms/Identity.php:54
xpac_social_login_form_success_message
Filter · 4 arguments · 1 call site
Filters the message a sign-up form shows once a provider sign-up has signed the visitor in.
Used whenever a provider sign-up through the form ends with the new account signed in, since the form's own message may have been written for an account that still has to confirm its address or sign in.
apply_filters( 'xpac_social_login_form_success_message', __('Your account is ready, and you are signed in.', '{XPAC}'), $formMessage, $formId, $userId )$message(string) — Message to show. Default "Your account is ready, and you are signed in."$formMessage(string) — The form's own success message.$formId(int) — The form.$userId(int) — The new account.
Fired from:
packages/UserProfiles/SocialLogin/Integrations/Forms/SignUp.php:653
xpac_social_login_linked
Action · 2 arguments · 1 call site
Fires after a signed-in user links a sign-in method to their account.
do_action( 'xpac_social_login_linked', get_current_user_id(), $providerId )$userId(int) — The WordPress account ID.$provider(string) — Provider ID: google, github, apple or discord.
Fired from:
packages/UserProfiles/SocialLogin/Core/Flow.php:259
xpac_social_login_remove_data_on_uninstall
Filter · 1 argument · 1 call site
Filters whether uninstalling Social Login deletes linked sign-in methods and provider settings.
False by default. Add the filter from an mu-plugin: the plugin being uninstalled is already deactivated when this runs.
apply_filters( 'xpac_social_login_remove_data_on_uninstall', false )$remove(bool) — Whether to drop the linked accounts table and delete the settings, the profile map and the extra permissions.
Fired from:
packages/UserProfiles/SocialLogin/Module.php:121
xpac_social_login_settings_page
Action · 0 arguments · 1 call site
Fires when the screen holding the Social Login settings loads, before its assets are enqueued.
The settings used to have a page of their own, which fired this; the Providers screen in User Profiles fires it now, for users who may set up sign-in.
do_action( 'xpac_social_login_settings_page' )Fired from:
packages/UserProfiles/Admin/MenuPage.php:94
xpac_social_login_sign_up_url
Filter · 1 argument · 1 call site
Filters the sign-up page the "no account" message links to.
Shown with a sign-in button outside a form when the provider account belongs to nobody, since only a sign-up form creates accounts. Defaults to wp_registration_url() when a plugin points it at a page, such as User Auth's registration page, or while "Anyone can register" is on. An empty string shows no link, and an address off this site is ignored.
apply_filters( 'xpac_social_login_sign_up_url', $url )$url(string) — Sign-up page URL, or an empty string.
Fired from:
packages/UserProfiles/SocialLogin/Core/Notice.php:115
xpac_social_login_unlinked
Action · 2 arguments · 1 call site
Fires after a signed-in user removes one of their linked sign-in methods.
do_action( 'xpac_social_login_unlinked', $userId, $provider )$userId(int) — The WordPress account ID.$provider(string) — Provider ID: google, github, apple or discord.
Fired from:
packages/UserProfiles/SocialLogin/Core/Controller.php:210
xpac_social_login_user_created
Action · 3 arguments · 1 call site
Fires after a visitor's first sign-up with a provider created their account through a sign-up form.
WordPress has already fired user_register, and the provider account is linked. This adds which provider was used and the public profile it returned; tokens and credentials are never part of it. The account may still have to verify its email.
do_action( 'xpac_social_login_user_created', $userId, Accounts::publicIdentity($memo['pass']), $memo['provider'] )$userId(int) — The new WordPress account ID.$identity(array) — Public provider profile: subject, email, email_verified, name, first_name, last_name, username, avatar_url, locale, profile_url; empty strings for what the provider did not send. Apple sends its names unsigned, the first time only. Any other claim, such as company or phone, is there only when the profile map places it and the provider sent it.$provider(string) — Provider ID, such as google.
Fired from:
packages/UserProfiles/SocialLogin/Integrations/Forms/SignUp.php:309
xpac_user_auth_abilities
Filter · 1 argument · 1 call site
Filters which Login abilities are registered for AI agents.
Asked whenever User Profiles reads which Login tools are on: when the
Abilities API registers abilities and when Agent builds its
instructions. Names are the part after xpac-user-auth/, such as
build-auth-pages. One left out is not registered at all, so no REST
route, MCP server or WordPress AI feature can call it. The default is
what XPAC Agent's switches allow, which is none while Agent is off or
absent. One added here is registered for the Abilities API and
WordPress's AI features, but Agent's chat and MCP server still offer
only what its switches allow.
apply_filters( 'xpac_user_auth_abilities', $allowed )$abilities(string[]) — Ability names. Default the ones XPAC Agent's switches allow.
Fired from:
packages/UserProfiles/Auth/Agent/Abilities.php:190
xpac_user_auth_agent_reserved_meta
Filter · 1 argument · 1 call site
Filters the user meta keys no User Auth form may write.
A registration or profile form saves each meta row through wp_insert_user() or wp_update_user(), which would write over whatever WordPress or a plugin keeps under that key. The agent tools refuse a listed key, saving a form strips it, and a submission leaves it out. Keys starting with an underscore or the table prefix, protected keys, the account's own fields and keys with surrounding space, a backslash or anything but printable ASCII are reserved whatever this answers. Compared without case. Remove a key, such as locale, to let a form write it.
apply_filters( 'xpac_user_auth_agent_reserved_meta', self::RESERVED )$keys(string[]) — Default session_tokens, use_ssl, rich_editing, syntax_highlighting, comment_shortcuts, admin_color, show_admin_bar_front, locale, default_password_nag, dismissed_wp_pointers, primary_blog, source_domain, nickname, first_name, last_name and description.
Fired from:
packages/UserProfiles/Auth/Core/UserMeta.php:96
xpac_user_auth_agent_role_ceiling
Filter · 1 argument · 1 call site
Filters the capabilities that make a role privileged.
A role carrying any of these is never given by a public registration form, whatever the form's author could grant: the account gets the site's default role instead and the refusal is logged. A profile form never changes the role of a member who holds one. The User Auth agent tools refuse such a role on a form and as the site's default role, and point to the form editor.
Remove a capability to let a site hand out the roles that carry it, such as unfiltered_html for public editor signups; add one to protect more roles. A return that is not an array keeps the default list.
apply_filters( 'xpac_user_auth_agent_role_ceiling', self::PRIVILEGED_CAPABILITIES )$capabilities(string[]) — Capability names. Default Roles::PRIVILEGED_CAPABILITIES.
Fired from:
packages/UserProfiles/Auth/Core/Roles.php:168
xpac_user_auth_agent_setup
Filter · 1 argument · 1 call site
Filters the sign-in setup get-auth-setup reports.
Another plugin adds what it knows about signing in under a key of its own, and may append
plain sentences to problems. Social Login adds social_login. The keys get-auth-setup sets
are kept as it built them.
apply_filters( 'xpac_user_auth_agent_setup', $setup + ['problems' => $problems] )$setup(array<string, mixed>) — The report.
Fired from:
packages/UserProfiles/Auth/Agent/Tools.php:181
xpac_user_auth_agent_sign_in_buttons
Filter · 3 arguments · 1 call site
Filters the result of adding providers' sign-in buttons to a form an auth tool just built.
Asked by make-auth-form and build-auth-pages when the call asks for sign_in_buttons. Social Login answers by adding its buttons to the form. Null means nothing added them, true that they were added, and a WP_Error why they were not. The form is kept either way, and anything but true becomes a warning.
apply_filters( 'xpac_user_auth_agent_sign_in_buttons', null, get_post($form->ID), $providers )$added(true|WP_Error|null) — Default null.$form(WP_Post) — The form just built.$providers(string[]) — Provider IDs as the call gave them, such as google and github.
Fired from:
packages/UserProfiles/Auth/Agent/Tools.php:1030
xpac_user_auth_form_action
Filter · 2 arguments · 2 call sites
Filters which User Auth action a form runs.
User Auth answers from the form's saved settings: the action of its first enabled item
that maps at least one field, or that has nothing mapped and takes its fields from the
form's profile-field blocks, such as registration or login, or an empty string when
it runs none. Null means User Auth is not running.
apply_filters( 'xpac_user_auth_form_action', null, $formId )$action(string|null) — Action name. Default null.$formId(int) — The form.
Fired from:
packages/UserProfiles/Forms/AccountFields.php:527packages/UserProfiles/SocialLogin/Integrations/UserAuth.php:85
xpac_user_auth_verification_meta
Filter · 1 argument · 1 call site
Filters the user meta that puts a new account into email verification.
Social Login reads it only to learn whether new accounts must confirm their email; its "Skip email verification for social sign-ups" switch shows only then. User Auth adds its verification marker while its email verification setting is on and its verification page is set.
apply_filters( 'xpac_user_auth_verification_meta', [] )$meta(array<string, int>) — Meta key => value. Empty when verification is off.
Fired from:
packages/UserProfiles/SocialLogin/Integrations/UserAuth.php:37
xpac_user_auth_verification_pending
Filter · 2 arguments · 2 call sites
Filters whether an account still has to verify its email before signing in.
apply_filters( 'xpac_user_auth_verification_pending', false, $user )$pending(bool) — Whether verification is pending. Default false.$user(WP_User) — The account signing in.
Fired from:
packages/UserProfiles/Notifications/Bridge.php:138packages/UserProfiles/SocialLogin/Integrations/UserAuth.php:51
xpac_user_auth_verification_sql
Filter · 2 arguments · 1 call site
Filters the SQL that selects the ids of the accounts in one email verification state.
User Auth answers it while it runs. The list tests ID IN (...) with it.
apply_filters( 'xpac_user_auth_verification_sql', '', $state )$sql(string) — A SELECT of user ids. Default empty.$state(string) — 'confirmed' or 'pending'.
Fired from:
packages/UserProfiles/Admin/Users.php:1620
xpac_user_auth_verification_states
Filter · 2 arguments · 1 call site
Filters the email verification of a list of accounts, asked once for the whole list.
User Auth answers it while it runs.
apply_filters( 'xpac_user_auth_verification_states', [], $userIds )$states(array) — User id => 'confirmed' once the account confirmed its email, or 'pending' while it still has to. An account never asked is left out.$userIds(int[]) — The accounts.
Fired from:
packages/UserProfiles/Admin/Users.php:1589
xpac_user_auth_verification_url
Filter · 1 argument · 1 call site
Filters the published page whose form resends the email-verification message.
apply_filters( 'xpac_user_auth_verification_url', '' )$url(string) — Page URL. Empty when there is none.
Fired from:
packages/UserProfiles/SocialLogin/Integrations/UserAuth.php:62
xpac_user_profiles_abilities
Filter · 1 argument · 1 call site
Filters which User Profiles abilities are registered for AI agents.
Asked whenever User Profiles reads which of its tools are on: when
the Abilities API registers abilities and when Agent builds its
instructions. Names are the part after xpac-user-profiles/, such as
add-profile-field. One left out is not registered at all, so no REST
route, MCP server or WordPress AI feature can call it. The default is
what XPAC Agent's switches allow, which is none while Agent is off or
absent. One added here is registered for the Abilities API and
WordPress's AI features, but Agent's chat and MCP server still offer
only what its switches allow.
apply_filters( 'xpac_user_profiles_abilities', $allowed )$abilities(string[]) — Ability names. Default the ones XPAC Agent's switches allow.
Fired from:
packages/UserProfiles/Agent/Abilities.php:195
xpac_user_profiles_account_field_targets
Filter · 2 arguments · 1 call site
Filters which account field each profile field fills on a sign-in form with no mapping.
Keys are profile field keys, values account fields such as user_url or
display_name. A value an action does not read is ignored for that
action, a password field only fills user_pass, and the five built-in
keys always keep their own account field.
apply_filters( 'xpac_user_profiles_account_field_targets', self::DEFAULTS, $submission )$targets(array<string, string>) — Profile field key => account field.$submission(Submission|null) — A callback-safe submission, or null outside one.
Fired from:
packages/UserProfiles/Forms/AccountFields.php:120
xpac_user_profiles_account_form_args
Filter · 2 arguments · 1 call site
Filters the post a Create on User Profiles › Forms and pages makes for a sign-in form.
The post type and the content are put back after the filter.
apply_filters( 'xpac_user_profiles_account_form_args', $postarr, $kind )$postarr(array<string, mixed>) — wp_insert_post() arguments.$kind(string) — Kind id.
Fired from:
packages/UserProfiles/Auth/AccountForms.php:775
xpac_user_profiles_account_form_assigned
Action · 3 arguments · 1 call site
Fires after a kind of sign-in form gets a new form in User Profiles › Forms and pages.
The new form's action is on, and the previous form's action of that kind is switched off, unless it is an update.
do_action( 'xpac_user_profiles_account_form_assigned', $kind, $change['form'], (int) $state[$kind]['form'] )$kind(string) — Kind id, such as login.$formId(int) — The new form, 0 when the kind was left without one.$previousFormId(int) — The form before, 0 when there was none.
Fired from:
packages/UserProfiles/Auth/AccountForms.php:698
xpac_user_profiles_account_form_badge
Filter · 3 arguments · 1 call site
Filters the badge Forms › All Forms shows after a sign-in form's #id.
Return null to show none.
apply_filters( 'xpac_user_profiles_account_form_badge', $badge, $kind, $form )$badge(array{label: string, intent: string, url: string, title: string}|null) — The badge.$kind(string) — Kind id.$form(WP_Post) — The form.
Fired from:
packages/UserProfiles/Auth/AccountForms.php:1341
xpac_user_profiles_account_form_blocks
Filter · 3 arguments · 1 call site
Filters the blocks of the minimal form a Create on User Profiles › Forms and pages makes.
Each entry is one serialized block, in order, placed in the Form builder. The Social Login block comes first when a provider is set up, and an account verification form's blocks are its Verification steps.
apply_filters( 'xpac_user_profiles_account_form_blocks', $blocks, $kind, $definitions )$blocks(string[]) — Serialized blocks.$kind(string) — Kind id.$definitions(array<string, array<string, mixed>>) — The profile fields used, by key.
Fired from:
packages/UserProfiles/Auth/AccountForms.php:2661
xpac_user_profiles_account_form_created
Action · 3 arguments · 1 call site
Fires after a Create on User Profiles › Forms and pages made a sign-in form, and its page if it has one.
do_action( 'xpac_user_profiles_account_form_created', $kind, $formId, $pageId )$kind(string) — Kind id.$formId(int) — The new form.$pageId(int) — Its page, new or reused; 0 for a kind with no page.
Fired from:
packages/UserProfiles/Auth/AccountForms.php:837
xpac_user_profiles_account_forms_seeded
Action · 1 argument · 1 call site
Fires once User Profiles made the sign-in forms and pages after a fresh activation.
do_action( 'xpac_user_profiles_account_forms_seeded', $created )$created(array<string, array{form: int, page: int}>) — Kind id => the form and page made, page 0 for a kind with no page.
Fired from:
packages/UserProfiles/Auth/AccountForms.php:3027
xpac_user_profiles_account_forms_state
Filter · 1 argument · 1 call site
Filters what User Profiles › Forms and pages reports for each kind of sign-in form.
Read once per request and kept until a form's settings, a sign-in page or the Forms option changes. The badge in Forms › All Forms, the AI tools and the screen all read this answer.
apply_filters( 'xpac_user_profiles_account_forms_state', $state )$state(array<string, array<string, mixed>>) — Kind id => {kind, form, page, status, problems, extra}.
Fired from:
packages/UserProfiles/Auth/AccountForms.php:292
xpac_user_profiles_account_kinds
Filter · 1 argument · 1 call site
Filters the kinds of sign-in form User Profiles › Forms and pages lists.
The six base kinds always stay, with their action, page key and
fields; only their text (label, hint, page_note, title, submit,
message) may be changed. An added kind needs a label, the stored
User Auth action it runs and a page_key starting with page_,
under an id of letters only.
apply_filters( 'xpac_user_profiles_account_kinds', $base )$kinds(array<string, array<string, mixed>>) — Kind id => {label, hint, page_key, page_note, action, agent, title, submit, message, fields}.
Fired from:
packages/UserProfiles/Auth/AccountForms.php:182
xpac_user_profiles_account_menu_line
Filter · 3 arguments · 1 call site
Filters the attributes of the group that holds the line under the name in the account menu.
A plugin adds its own rule for who sees the line here, such as the member's privacy choice for one of the fields.
apply_filters( self::LINE_FILTER, $group, $userId, $keys )$group(array<string, mixed>) — The core/group block's attributes.$userId(int) — The member whose menu it is.$keys(string[]) — The field keys the line shows, in order.
Fired from:
packages/UserProfiles/Blocks/AccountMenu.php:219
xpac_user_profiles_account_page_args
Filter · 3 arguments · 1 call site
Filters the page a Create on User Profiles › Forms and pages makes for a sign-in form.
The post type is put back to page after the filter.
apply_filters( 'xpac_user_profiles_account_page_args', $postarr, $kind, $formId )$postarr(array<string, mixed>) — wp_insert_post() arguments.$kind(string) — Kind id.$formId(int) — The form the page shows.
Fired from:
packages/UserProfiles/Auth/AccountForms.php:2835
xpac_user_profiles_account_page_assigned
Action · 3 arguments · 1 call site
Fires after a row of User Profiles › Forms and pages gets a new page.
The rows are the kinds of sign-in form and the Profile and Search pages.
do_action( 'xpac_user_profiles_account_page_assigned', $kind, $change['page'], self::storedPage($options, $all[$kind]) )$kind(string) — Kind id, such as login or profile.$pageId(int) — The new page, 0 when the kind was left without one.$previousPageId(int) — The page before, 0 when there was none.
Fired from:
packages/UserProfiles/Auth/AccountForms.php:675
xpac_user_profiles_account_rows
Filter · 4 arguments · 1 call site
Filters the account rows a form's profile-field blocks give one sign-in item.
Rows whose key the action does not read are dropped after the filter.
apply_filters( 'xpac_user_profiles_account_rows', array_values($derived), $action, $mapped, $submission->forExternalCallback() )$rows(array) —{key, value}rows: an account field and the block that fills it.$action(string) — The item's action, such asregistration.$mapped(bool) — Whether the item maps fields of its own.$submission(Submission) — A callback-safe clone without credential answers.
Fired from:
packages/UserProfiles/Auth/Modules/Bootstrap.php:819
xpac_user_profiles_account_settings_updated
Action · 2 arguments · 1 call site
Fires after the sign-in settings in User Profiles › Forms and pages change.
do_action( 'xpac_user_profiles_account_settings_updated', self::settings(), $before )$settings(array<string, mixed>) — The settings now, as AccountForms::settings() reads them.$previous(array<string, mixed>) — The settings before.
Fired from:
packages/UserProfiles/Auth/AccountForms.php:708
xpac_user_profiles_admin_boot
Filter · 1 argument · 1 call site
Filters the boot data the User Profiles admin app reads on load.
Add an extension's data under its own key, such as 'socialLogin'. The app's own keys are always kept.
apply_filters( 'xpac_user_profiles_admin_boot', $boot )$boot(array<string, mixed>) — Boot data, localized as xpacUserProfilesAdmin.
Fired from:
packages/UserProfiles/Admin/MenuPage.php:161
xpac_user_profiles_admin_dependencies
Filter · 1 argument · 1 call site
Filters the script handles the User Profiles admin app depends on.
Register an extension script with wp_register_script() before the page loads (admin_init is early enough) and add its handle here. Its xpacUserProfiles.admin.groups and xpacUserProfiles.admin.tabs filters then run before the app starts. Handles that are not registered are ignored.
apply_filters( 'xpac_user_profiles_admin_dependencies', [] )$handles(string[]) — Script handles. Default empty.
Fired from:
packages/UserProfiles/Admin/MenuPage.php:187
xpac_user_profiles_admin_enqueue
Action · 1 argument · 1 call site
Fires after the User Profiles admin app's own scripts and styles are enqueued.
Enqueue an extension's styles here. Its script goes in the app's dependencies through xpac_user_profiles_admin_dependencies instead.
do_action( 'xpac_user_profiles_admin_enqueue', $handle )$appHandle(string) — The app script's handle.
Fired from:
packages/UserProfiles/Admin/MenuPage.php:118
xpac_user_profiles_agent_locked_answers
Filter · 2 arguments · 1 call site
Filters the profile fields the AI agent never changes for a member.
By default the Email Address of a member with admin powers, since whoever controls that address can reset the account's password. update-member-answers refuses these keys, naming the field.
apply_filters( 'xpac_user_profiles_agent_locked_answers', $default, $user )$keys(string[]) — Profile field keys. Default['user-email']for a privileged member, else none.$member(WP_User) — The member.
Fired from:
packages/UserProfiles/Agent/Members.php:395
xpac_user_profiles_agent_member
Filter · 2 arguments · 1 call site
Filters a member's page as the AI agent's get-member tool gives it.
Add what an agent should know about a member, such as a membership
plan. Password and confirmation fields, every write-only field, and
keys such as user_pass are taken out again after this filter, so
no listener can hand an agent a password.
apply_filters( 'xpac_user_profiles_agent_member', $view, $user )$view(array) — The member: id, name, email, roles, sign_in, sets and links.$member(WP_User) — The member.
Fired from:
packages/UserProfiles/Agent/Members.php:369
xpac_user_profiles_allow_admin_access
Filter · 2 arguments · 2 call sites
Filters whether a member may open this admin request.
Members are users with the subscriber role, kept out of wp-admin while "Keep members out of wp-admin" is on. Returning true lets this one request through; WordPress's own screen, capability and nonce checks still run. Ajax requests never reach the filter.
apply_filters( self::FILTER, false, $user )$allowed(bool) — Whether this admin request is let through. Default false.$user(WP_User) — The member.
Fired from:
packages/UserProfiles/Auth/Core/AdminAccess.php:182packages/UserProfiles/Auth/Core/AdminAccess.php:233
xpac_user_profiles_answers_saved
Action · 3 arguments · 1 call site
Fires after an admin changes a person's profile answers.
A null value is an answer that was cleared.
do_action( 'xpac_user_profiles_answers_saved', $userId, $clean, $before )$userId(int) — The user.$changes(array) — Field key => the value saved, or null when cleared.$before(array) — Every answer before the change, key => value.
Fired from:
packages/UserProfiles/Core/Answers.php:201
xpac_user_profiles_avatar_sizes
Filter · 1 argument · 1 call site
Filters the sizes an uploaded profile photo is saved in.
The main and small sizes are always kept. A size needs a positive width and height.
apply_filters( 'xpac_user_profiles_avatar_sizes', $required )$sizes(array) — Size name => ['width' => int, 'height' => int, 'crop' => bool].
Fired from:
packages/UserProfiles/Core/Avatar.php:103
xpac_user_profiles_capability
Filter · 1 argument · 1 call site
Filters the capability needed to manage members, profile fields and field sets.
Gates the Members and Profile fields screens, their REST routes and the AI tools for them. Sign-in setup has its own capability, see xpac_user_profiles_login_capability.
apply_filters( 'xpac_user_profiles_capability', self::DEFAULT )$capability(string) — The capability. Default 'manage_options'.
Fired from:
packages/UserProfiles/Core/Capability.php:29
xpac_user_profiles_check_password_strength
Filter · 3 arguments · 1 call site
Filters whether a form's password fields check how strong a password is.
Every form checks it except a login form, which takes the password the member already has, however weak.
apply_filters( 'xpac_user_profiles_check_password_strength', 'login' !== $action, $action, $formId )$check(bool) — Whether to check. Default true, false on login forms.$action(string) — The form's sign-in action, '' for none.$formId(int) — The form.
Fired from:
packages/UserProfiles/Forms/AccountFields.php:539
xpac_user_profiles_directory_card_actions
Filter · 3 arguments · 1 call site
Filters the block markup of the actions under a directory card, such as buttons to connect or send a message.
Every block in it gets the card's user as userId context.
apply_filters( 'xpac_user_profiles_directory_card_actions', '', $user, $attributes )$blockMarkup(string) — Block markup. Default ''.$user(WP_User) — The card's user.$attributes(array) — The block's sanitized query attributes.
Fired from:
packages/UserProfiles/Blocks/templates/users-query/item.php:43
xpac_user_profiles_directory_context_free_filters
Filter · 1 argument · 1 call site
Filters the "filterBy" values a stateless request can rebuild from the attributes and the signed-in user.
apply_filters( self::CONTEXT_FREE_FILTER, [''] )$filters(string[]) — The values. Default [''].
Fired from:
packages/UserProfiles/Core/Directory.php:261
xpac_user_profiles_directory_excluded_users
Filter · 1 argument · 1 call site
Filters the users left out of the directory and the search.
apply_filters( self::EXCLUDED_FILTER, $stored )$ids(int[]) — User IDs.
Fired from:
packages/UserProfiles/Core/Directory.php:196
xpac_user_profiles_directory_query_args
Filter · 3 arguments · 1 call site
Filters the directory's user query, built from a Users Query block's attributes.
Plugins turn their own "filterBy" values into query vars here.
apply_filters( self::QUERY_ARGS_FILTER, $queryArgs, $attributes, true )$queryArgs(array<string, mixed>) — WP_User_Query arguments.$attributes(array<string, mixed>) — The sanitized block attributes.$front(bool) — Whether the query is for the site's pages.
Fired from:
packages/UserProfiles/Core/Directory.php:163
xpac_user_profiles_displayed_user_id
Filter · 1 argument · 1 call site
Filters the person a page shows, whose profile answers member blocks and rules use.
A member's own profile page answers with that member; elsewhere it is the signed-in member.
apply_filters( 'xpac_user_profiles_displayed_user_id', $userId )$userId(int) — The person. Default the signed-in member.
Fired from:
packages/UserProfiles/Core/Visibility.php:356
xpac_user_profiles_emails_before_verification
Filter · 1 argument · 1 call site
Filters the notification types whose email reaches an account that still has to verify its address.
Every other type's email waits until the address is verified; its notice stays on the site.
apply_filters( 'xpac_user_profiles_emails_before_verification', [UserNotifications::WELCOME, UserNotifications::PASSWORD_RESET] )$types(string[]) — Notification types. Default the welcome and the password reset notices.
Fired from:
packages/UserProfiles/Notifications/Bridge.php:118
xpac_user_profiles_excluded_dynamic_vars
Filter · 1 argument · 1 call site
Filters the {{name}} variables a paragraph leaves for something else to fill.
apply_filters( self::EXCLUDED_FILTER, [] )$names(string[]) — Variable names, as written between the braces.
Fired from:
packages/UserProfiles/Core/DynamicVariables.php:94
xpac_user_profiles_field_created
Action · 2 arguments · 2 call sites
Fires after a profile field is created.
do_action( 'xpac_user_profiles_field_created', (int) $postId, $field )$fieldId(int) — The field's post id.$field(array) — The field, as the REST route returns it.
Fired from:
packages/UserProfiles/Core/Fields.php:411packages/UserProfiles/Core/Fields.php:618
xpac_user_profiles_field_data
Filter · 2 arguments · 1 call site
Filters a profile field, or its summary on the board, before it is returned.
apply_filters( 'xpac_user_profiles_field_data', $data, $post )$data(array) — The field.$post(WP_Post) — The field's post.
Fired from:
packages/UserProfiles/Core/Fields.php:1099
xpac_user_profiles_field_deleted
Action · 2 arguments · 1 call site
Fires after a profile field is moved to the trash. Its saved answers are kept.
do_action( 'xpac_user_profiles_field_deleted', $post->ID, $field )$fieldId(int) — The field's post id.$field(array) — The field as it was, as the REST route returns it.
Fired from:
packages/UserProfiles/Core/Fields.php:832
xpac_user_profiles_field_types
Filter · 1 argument · 1 call site
Filters the field types the User Profiles screen creates and edits.
Keys are Forms field types; a type Forms does not write is ignored. Fields of a type left out stay listed, and are edited in the block editor.
apply_filters( 'xpac_user_profiles_field_types', $labels )$types(array<string, string>) — Type => label.
Fired from:
packages/UserProfiles/Core/Fields.php:108
xpac_user_profiles_field_updated
Action · 3 arguments · 1 call site
Fires after a profile field is changed.
do_action( 'xpac_user_profiles_field_updated', $post->ID, $field, $before )$fieldId(int) — The field's post id.$field(array) — The field after the change, as the REST route returns it.$before(array) — The field before the change.
Fired from:
packages/UserProfiles/Core/Fields.php:791
xpac_user_profiles_incomplete_profile_mode
Filter · 1 argument · 1 call site
Filters how a later daily run meets the profile reminder a user already has.
Once only refreshes an unread reminder and never brings a read one back. Group moves an unread reminder back to the top and brings a read one back as unread, with a new email.
apply_filters( self::MODE_FILTER, 'once' )$mode(string) — Default once.
Fired from:
packages/UserProfiles/Notifications/UserNotifications.php:176
xpac_user_profiles_incomplete_profile_skip_caps
Filter · 1 argument · 1 call site
Filters the capabilities whose holders never get the profile reminder.
apply_filters( self::SKIP_CAPS_FILTER, ['manage_options'] )$caps(string[]) — Default manage_options.
Fired from:
packages/UserProfiles/Notifications/UserNotifications.php:328
xpac_user_profiles_incomplete_profile_threshold
Filter · 1 argument · 1 call site
Filters the profile completion, in percent, below which a user gets the daily reminder.
Zero or less turns the reminder off.
apply_filters( self::THRESHOLD_FILTER, 80 )$threshold(int|float) — Default 80.
Fired from:
packages/UserProfiles/Notifications/UserNotifications.php:297
xpac_user_profiles_login_capability
Filter · 1 argument · 1 call site
Filters the capability needed to set up sign-in: account forms and pages, Social Login keys and Sign-up data.
Gates the Login screens of the User Profiles app, their REST routes, the Forms badge and editor links into them, and the site-wide Login AI tools.
apply_filters( 'xpac_user_profiles_login_capability', self::LOGIN_DEFAULT )$capability(string) — The capability. Default 'manage_options'.
Fired from:
packages/UserProfiles/Core/Capability.php:60
xpac_user_profiles_member_url
Filter · 2 arguments · 1 call site
Filters the address of a member's profile, which account and member blocks link to.
Empty means the member has no profile to open, and the links are left out.
apply_filters( self::MEMBER_URL_FILTER, '', $user )$url(string) — The address. Default ''.$user(WP_User) — The member.
Fired from:
packages/UserProfiles/Blocks/AccountMenu.php:140
xpac_user_profiles_notification_people
Filter · 1 argument · 1 call site
Filters the notification types that name another user, whose profile fields their templates offer.
The prefix starts each of that user's tag names (lowercase letters and digits, not "profile"), the label names the group, and the path leads to the user's id in the notice's data, keys joined by dots.
apply_filters( self::PEOPLE_FILTER, [] )$people(array<string, array{prefix: string, label: string, path: string}>) — By notification type, none until a plugin adds its own.
Fired from:
packages/UserProfiles/Notifications/ProfileTags.php:154
xpac_user_profiles_order_saved
Action · 1 argument · 1 call site
Fires after the order of field sets and fields is saved.
do_action( 'xpac_user_profiles_order_saved', $board )$board(array) — The board after the change: sets with their fields, and the field types.
Fired from:
packages/UserProfiles/Core/FieldSets.php:351
xpac_user_profiles_privacy_choices
Filter · 1 argument · 1 call site
Filters the privacy choices a setting can offer.
Add a choice by id; who matches it is decided on xpac_user_profiles_privacy_match.
apply_filters( self::CHOICES_FILTER, $own )$choices(array<string, array{title: string, description: string, icon: string}>) — The choices.
Fired from:
packages/UserProfiles/Core/Privacy.php:291
xpac_user_profiles_privacy_match
Filter · 5 arguments · 1 call site
Filters whether a viewer matches a privacy choice another plugin added.
Asked only for a signed-in viewer who is neither the user nor an administrator.
apply_filters( self::MATCH_FILTER, false, $choice, $ownerId, $viewerId, $settingId )$match(bool) — Whether the viewer may see it. Default false.$choice(string) — The user's choice.$ownerId(int) — The user.$viewerId(int) — The viewer.$settingId(string) — Setting id.
Fired from:
packages/UserProfiles/Core/Privacy.php:699
xpac_user_profiles_privacy_values
Filter · 3 arguments · 1 call site
Filters a user's settings before a group's privacy relations are checked against them.
A value set to null counts as unset: it never lets anyone see.
apply_filters( self::VALUES_FILTER, $values, $ownerId, $relation )$values(array<string, array<string, mixed>>) — Each setting with itsvalue, by id.$ownerId(int) — The user.$relation(string) — and or or.
Fired from:
packages/UserProfiles/Core/Privacy.php:449
xpac_user_profiles_profile_field_saved
Action · 3 arguments · 1 call site
Fires after a person's profile answer is saved or cleared, whoever saved it.
do_action( self::FIELD_SAVED, $userId, $key, (string) $value )$userId(int) — The person.$name(string) — Field key.$value(string) — The value saved, '' when cleared.
Fired from:
packages/UserProfiles/Core/Answers.php:406
xpac_user_profiles_protected_page_redirect
Filter · 1 argument · 1 call site
Filters where a signed-in member goes instead of a protected page.
Protected pages are the account page, the member-only pages and post types, and the profile page while Public Profiles is off. Signed-out visitors go to the login page and never reach the filter. User Profiles sends unverified members to the account verification page (priority 20) when member-only pages need a verified account, and members who have not finished onboarding to the first onboarding page (priority 100) when onboarding is mandatory.
apply_filters( self::REDIRECT_FILTER, null )$url(string|null) — Where to send the member. Default null, which lets them in.
Fired from:
packages/UserProfiles/Auth/Modules/Access/Module.php:169
xpac_user_profiles_render_profile_data
Filter · 3 arguments · 1 call site
Filters whether a profile data block shows a person's answer.
apply_filters( self::RENDER_FILTER, true, $userId, $key )$render(bool) — Whether to show it. Default true.$userId(int) — The person.$key(string) — Field key.
Fired from:
packages/UserProfiles/Blocks/ProfileData.php:146
xpac_user_profiles_reserved_keys
Filter · 1 argument · 1 call site
Filters the keys no new profile field may use.
The built-in keys are always reserved, whatever this returns.
apply_filters( 'xpac_user_profiles_reserved_keys', self::BUILT_IN )$keys(string[]) — Reserved keys.
Fired from:
packages/UserProfiles/Core/Fields.php:149
xpac_user_profiles_retired_plugins
Filter · 1 argument · 1 call site
Filters the old standalone plugins that are part of User Profiles now.
An active plugin in one of these folders is turned off and the admin is told once. Remove a folder to leave that plugin running. Asked at plugins_loaded 1 with the names untranslated, when only the folders are used, and again with them translated when the notice prints.
apply_filters( 'xpac_user_profiles_retired_plugins', $defaults )$plugins(array<string,string>) — Plugin folder => name shown in the notice.
Fired from:
packages/UserProfiles/Core/RetiredPlugins.php:173
xpac_user_profiles_retired_plugins_deactivated
Action · 2 arguments · 1 call site
Fires after User Profiles turned off old standalone plugins that are part of it now.
Fires once for this site's plugins and once for network-active ones. Their own deactivation hooks did not run.
do_action( 'xpac_user_profiles_retired_plugins_deactivated', $basenames, $networkWide )$basenames(string[]) — Plugin basenames, such as 'xpac-user-auth/plugin.php'.$networkWide(bool) — Whether they were turned off across the network.
Fired from:
packages/UserProfiles/Core/RetiredPlugins.php:417
xpac_user_profiles_save_profile_fields
Filter · 2 arguments · 1 call site
Filters the profile answers a form saves.
apply_filters( self::SAVE_FILTER, array_map(static fn($value): string => (string) $value, $clean), $original )$values(array) — Field key => value, lists joined with commas, '' when empty.$original(array) — The submitted rows,{slug, name, value}.
Fired from:
packages/UserProfiles/Core/Answers.php:289
xpac_user_profiles_seed_account_forms
Filter · 1 argument · 1 call site
Filters whether User Profiles makes the six sign-in forms and five pages after a fresh activation.
Asked once, on the first admin load after activation on a site with no sign-in setup. Return false to leave the site without them; they can be made one by one in User Profiles › Forms and pages.
apply_filters( 'xpac_user_profiles_seed_account_forms', true )$seed(bool) — Whether to make them. Default true.
Fired from:
packages/UserProfiles/Auth/AccountForms.php:2955
xpac_user_profiles_set_deleted
Action · 2 arguments · 1 call site
Fires after a field set is deleted.
do_action( 'xpac_user_profiles_set_deleted', $id, $set )$setId(int) — The set's term id.$set(array) — The set as it was: id, name, description, built_in, order.
Fired from:
packages/UserProfiles/Core/FieldSets.php:257
xpac_user_profiles_set_saved
Action · 3 arguments · 2 call sites
Fires after a field set is created or changed.
do_action( 'xpac_user_profiles_set_saved', $id, $set, true )
do_action( 'xpac_user_profiles_set_saved', $id, $set, false )$setId(int) — The set's term id.$set(array) — The set: id, name, description, built_in, order.$created(bool) — Whether the set was just created.
Fired from:
packages/UserProfiles/Core/FieldSets.php:145packages/UserProfiles/Core/FieldSets.php:203
xpac_user_profiles_sign_in_methods
Filter · 2 arguments · 1 call site
Filters the ways a person can sign in, shown on their page in User Profiles.
User Profiles adds the password when the account has one of its own.
A sign-in plugin adds each method it links, such as google.
apply_filters( 'xpac_user_profiles_sign_in_methods', $methods, $user )$methods(array) — Each method as ['id' => string, 'label' => string].$user(WP_User) — The person.
Fired from:
packages/UserProfiles/Admin/Users.php:1311
xpac_user_profiles_signed_in_landing
Filter · 2 arguments · 1 call site
Filters where a signed-in visitor goes from the login or registration page.
The default is the visitor's profile page when the site has one, then where the login form's redirect sends a visitor who signs in, otherwise where the page's own guard sends them.
apply_filters( self::LANDING_FILTER, '' !== $landing ? $landing : $url, $user )$url(mixed) — Where to send the visitor.$user(WP_User) — The signed-in visitor.
Fired from:
packages/UserProfiles/Auth/Modules/Access/Account.php:159
xpac_user_profiles_signed_up_with
Filter · 2 arguments · 1 call site
Filters the sign-in provider an account was created with.
Null for an account made any other way. A sign-in plugin answers with the provider whose sign-up made the account.
apply_filters( 'xpac_user_profiles_signed_up_with', null, $user )$method(array|null) — ['id' => string, 'label' => string], or null.$user(WP_User) — The person.
Fired from:
packages/UserProfiles/Admin/Users.php:1343
xpac_user_profiles_social_login_settings_updated
Action · 2 arguments · 1 call site
Fires after the Providers screen or an AI tool saved Social Login settings.
do_action( 'xpac_user_profiles_social_login_settings_updated', array_map('strval', array_keys($values)), $state )$names(string[]) — The settings sent, by name.$state(array) — The new state, without secrets. See xpac_user_profiles_social_login_state.
Fired from:
packages/UserProfiles/SocialLogin/Core/ProviderSettings.php:183
xpac_user_profiles_social_login_state
Filter · 2 arguments · 1 call site
Filters the Social Login settings the Providers screen and the AI tools read.
Secret values are blanked again after this filter whenever they were not asked for, so a callback cannot leak one.
apply_filters( 'xpac_user_profiles_social_login_state', $state, $secrets )$state(array) — general: {show_login_buttons, skip_email_verification, verification}, providers: list<{id, label, enabled, configured, ready, callback_url, steps, guide, needs_https, fields: list<{name, type, label, help, secret, value, saved}>}>}.$secrets(bool) — Whether secret values are included.
Fired from:
packages/UserProfiles/SocialLogin/Core/ProviderSettings.php:123
xpac_user_profiles_user_data
Filter · 2 arguments · 1 call site
Filters a person's summary in the User Profiles list, or their page, before it is returned.
Add statuses entries, each ['id' => string, 'label' => string,
'intent' => 'success'|'warning'|'error'|'info'], to show a badge next
to the email status. In the list and on the page, avatar_removable
says whether the person has an uploaded photo to remove, and
can_suspend whether the current user may suspend them or lift it.
On the page, in_user_search is whether an administrator shows in
the user directory and search, null for anyone else.
apply_filters( 'xpac_user_profiles_user_data', $data, $user )$data(array) — The summary or the page.$user(WP_User) — The person.
Fired from:
packages/UserProfiles/Admin/Users.php:1448
xpac_user_profiles_user_filters
Filter · 1 argument · 1 call site
Filters the statuses the User Profiles list can filter by.
Add ['id' => string, 'label' => string] and apply it through
xpac_user_profiles_users_query_args when the request's filter equals
its id; show it on each person it applies to through
xpac_user_profiles_user_data. An id is 1-64 lowercase letters, digits,
- or _. The app's own statuses, the email ones and Suspended, always stay first and cannot be replaced.
apply_filters( 'xpac_user_profiles_user_filters', $base )$filters(array) — Each status as ['id' => string, 'label' => string, 'count'?: int].
Fired from:
packages/UserProfiles/Admin/Users.php:703
xpac_user_profiles_user_profile_fields
Filter · 3 arguments · 1 call site
Filters a person's profile answers before they are shown.
apply_filters( self::FIELDS_FILTER, $fields, $userId, $this )$fields(array) — Field key => value, the account's own values included.$userId(int) — The person.$profiles(Profiles) — This object.
Fired from:
packages/UserProfiles/Core/Profiles.php:601
xpac_user_profiles_user_suspended
Action · 2 arguments · 1 call site
Fires after a user is suspended or unsuspended.
do_action( self::CHANGED_ACTION, $userId, $now )$userId(int) — The user.$suspended(bool) — Whether the user is now suspended.
Fired from:
packages/UserProfiles/Auth/Core/Suspension.php:279
xpac_user_profiles_users_query_args
Filter · 2 arguments · 2 call sites
Filters the WP_User_Query arguments of the User Profiles list and its CSV export.
A plugin that adds a status through xpac_user_profiles_user_filters
applies it here when the request's filter is its id.
apply_filters( 'xpac_user_profiles_users_query_args', $args, $request )
apply_filters( 'xpac_user_profiles_users_query_args', self::withSuspended($args, $status), $probe )$args(array) — WP_User_Query arguments.$request(WP_REST_Request) — The list or export request.
Fired from:
packages/UserProfiles/Admin/Users.php:306packages/UserProfiles/Admin/Users.php:1101
xpac_user_profiles_write_only_fields
Filter · 1 argument · 1 call site
Filters the profile field keys whose answers are never kept.
A write-only field's answer goes to the account, such as a password, and is never saved as a profile answer, shown, exported or prefilled.
apply_filters( 'xpac_user_profiles_write_only_fields', $keys )$keys(string[]) — Field keys. Default the Password field's key.
Fired from:
packages/UserProfiles/Core/Fields.php:218
xpacUserProfiles.admin.groups
Filter · 2 arguments · 1 call site
Filters the sidebar groups of the User Profiles admin app.
Add a group for an extension's screens. The app's own groups are users
(Users), login (Login) and social (Social Login), and they always stay; entries without an
id and a label are dropped. The old ids profile and sign-in now mean
users and login, so a group added under one of them is dropped.
applyFilters( 'xpacUserProfiles.admin.groups', [...base], bootData )groups(Object[]) — Groups in order, each{id, label}.bootData(Object) — The app's boot data, with what extensions added through xpac_user_profiles_admin_boot.
Fired from:
assets/packages/user-profiles/admin/extensions.js:93
xpacUserProfiles.admin.tabs
Filter · 2 arguments · 1 call site
Filters the screens of the User Profiles admin app.
Add a screen in createAdminApp's shape. The app's own screens are
users, fields, forms, social-login and sign-up-data; they always
stay and cannot be replaced. Entries without an id, label, Component and
group are dropped. requires names a key of the boot data's caps:
manage (members and profile fields) or login (sign-in and Social Login setup). A
screen in the old group profile or sign-in shows in users or
login.
applyFilters( 'xpacUserProfiles.admin.tabs', [...base], bootData )tabs(Object[]) — Screens in order, each{id, label, Component, group, requires}.bootData(Object) — The app's boot data, with what extensions added through xpac_user_profiles_admin_boot.
Fired from:
assets/packages/user-profiles/admin/extensions.js:127
xpacUserProfiles.directory.filterOptions
Filter · 1 argument · 1 call site
The hook other plugins add their "Filter by" choices on, each {label, value}.
applyFilters( 'xpacUserProfiles.directory.filterOptions', [] )Fired from:
assets/packages/user-profiles/blocks/users-query/filter-options.js:17