When a user types an incorrect user name or password, by default Drupal gives this message: "Sorry, unrecognized username or password."

To help my sometimes clueless users (and my clueless self), I'd like to provide more helpful messages to specify exactly what is wrong.

In other words:

  • Incorrect password= "The password you provided is incorrect."
  • Account does not exist= "No account is registered for USERNAME."

How could I go about doing this?

  • 6
    The message is like that for security reasons...Changing it to how you're suggesting would make it easy for an attacker to find out which usernames are valid in the system and concentrate brute force attacks against them. Keeping the message ambiguous is good security practice.
    – Clive
    Mar 28, 2012 at 9:15
  • I strongly suggest you go by @Clive 's comment and keep the message as ambiguous it is.
    – D34dman
    Mar 29, 2013 at 16:33

2 Answers 2


This message is set in user.module in the user_login_final_validate() function. It's set as a bog-standard form_set_error() so can't really be over-ridden. Looking at it, it also doesn't differentiate between whether or not the username or password is incorrect, so you wouldn't really be able to do anything useful.

As Clive mentioned, it's much better practice to keep a degree of ambiguity in certain error messages, and seeing as how this isn't wrapped in any kind of theme function and doesn't have separate behaviours for whether the username exists or password was incorrect, you're probably better off leaving it as is.

One last option you have is to user a hook_form_alter() on user_form to set an extra validation callback, and then check for the user name yourself.


(I can't remember the $form_state for the user form, so you'll have to die() or dpm() that yourself)

function mymodule_check_username_exists($form, &$form_state){
  $user_exists = user_load_by_name($form_state['name']);

  if ($user_exists == FALSE ) {
   form_set_error('name', t('This username does not exist'));

Have you check user_login_authenticate_validate() and user_login_final_validate()

I think you can work your way using anyone of those.

Hope that helps.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.