invalid_email or user_email ?

[juliobox]

Hey there,

I'm talking about login error keys.
Here are the 3 things we can find in the WP Core:

<?php
$errors->add( 'invalid_email', __( '<strong>Error:</strong> There is no account with that username or email address.' ) );
$errors->add( 'invalid_email', __( '<strong>Error:</strong> The email address is not correct.' ) );
$errors->add( 'user_email', __( '<strong>Error:</strong> The email address is not correct.' ), array('form-field' => 'email', ) );

The 1st is an error message when you try to login using an email address that is not used as a user in this site, the key is "invalid_email"
The 2nd is an error message when you try to register a new user with an email address that is not correctly formatted, the key is "invalid_email"
The 3rd is an error message when you try to update your personal profile with an email address that is not correctly formatted, the key is "user_email"

So we have 2 keys and 2 messages (like "A1 A2 B2", should be "A1 B2 B2") but the message 2 is sharing both, we should clearly decide is "invalid_email" is when the email does not exists in our site OR when the email is not correctly formatted.

I suggest that the 2nd message should share the "user_email" and let the "invalid_*" for the login stuff, like we already have "invalidcombo" or "invalid_username" that shares the same kind of issue.

thanks for your reading time

[rajinsharwar]

Hi @juliobox, thanks for your suggestion! Are there any specific use cases for this change in your mind, like why this change should be made and solves what problem?

[juliobox]

First, just by consistency.
Then, as a security plugin, I need to check what kind of user/email error I'm handling.
Is is a incorrect_email one ? a user-email one ?
Because of the lack of consistency, I can't decide, I have to check the translated labels. Ho wait, there is also a lack of consistency
See what I mean?

This is why I think this is a first step into "email errors consistency", I bet there are other ones here and there.

We have to decide what is an "invalid email", what is a "user email", what is a "empty_email", what is a "email_exist" with the correct labels.

WordPress currently uses the invalid_email error code for two different situations:

Login / password reset — no user exists for the given email address.
Registration / profile update — the email fails is_email() format validation.
That overlap makes it hard for plugins and themes to branch on error type without inspecting translated message strings.

This change aligns format-validation errors with the existing user_email convention (already used in multisite signup validation):

user_email — malformed email on registration (register_new_user()) and profile/user edit (edit_user()).
invalid_email — unchanged for unknown/unregistered email during login, application passwords, and password reset.
Also adds user_email to the login form shake error codes in wp-login.php so registration errors shake the form consistently.

Includes PHPUnit coverage for both registration and profile validation paths.

Backward compatibility: Code that checks invalid_email only on registration or profile update for format errors will need to handle user_email as well.

Trac ticket: https://core.trac.wordpress.org/ticket/60737

Use of AI Tools
AI assistance: Yes
Tool(s): Cursor (Auto)
Used for: Exploring the codebase and drafting this PR description. Final code was edited and reviewed by me.

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request.