Use site host in backup codes download title by faithcoder · Pull Request #964 · WordPress/two-factor

faithcoder · 2026-08-25T10:46:02Z

What?

Use the site's host instead of its full URL in the heading of downloaded backup-code files, and make the heading filterable.

Fixes #957

Why?

The current heading includes the scheme and path from home_url( '/' ), which makes the recovery-code file contain a directly usable target URL. The host alone still identifies the site while matching the existing translator comment and avoiding unnecessary URL details.

How?

Parse the host from home_url() with wp_parse_url().
Add the two_factor_backup_codes_download_title filter, including the generated title and user as arguments.
Add REST API regression coverage confirming that the download contains the host but not the full home URL and that the title can be filtered.

Use of AI Tools

AI assistance: Yes
Tool(s): Codex
Model(s): GPT-5
Used for: Investigating the issue, implementing the change, adding tests, and running validation. The resulting diff was reviewed before submission.

Testing Instructions

Generate backup codes for a user through the REST API or user profile.
Download the recovery-code file.
Confirm its heading contains only the site's host, without the URL scheme or path.
Add a callback to two_factor_backup_codes_download_title, generate codes again, and confirm the custom heading appears.

Validation performed:

PHP syntax checks passed for both changed files.
PHPCS passed for both changed files.
PHPStan passed for the changed provider.
git diff --check passed.
The full PHPUnit suite was not run because the required Docker environment was unavailable.

Changelog Entry

Fixed - Use the site host instead of the full URL in backup-code download headings and allow the heading to be filtered.

github-actions · 2026-08-25T10:46:12Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: faithcoder <faithcoder@git.wordpress.org>
Co-authored-by: masteradhoc <masteradhoc@git.wordpress.org>
Co-authored-by: dknauss <dpknauss@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

Copilot

🟡 Changes recommended

The new filter’s documented $user argument isn’t actually covered by the added test (it registers the filter for 1 accepted arg and doesn’t assert the user is passed).

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the backup-codes download heading generated by the Backup Codes provider to avoid including a full home URL, and introduces a new filter to allow site owners to customize that heading.

Changes:

Use wp_parse_url( home_url(), PHP_URL_HOST ) so the default download title includes only the site host (not scheme/path).
Add a two_factor_backup_codes_download_title filter that receives the generated title and the target WP_User.
Extend REST API tests to validate the host-only behavior and that the title can be filtered.

File summaries

File	Description
`providers/class-two-factor-backup-codes.php`	Switches the default download title to use host-only and applies a new filter to allow customizing the title.
`tests/providers/class-two-factor-backup-codes-rest-api.php`	Adds REST API regression assertions for host-only title generation and basic filterability of the title.

Review details

Files reviewed: 2/2 changed files
Comments generated: 1
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+		$filter = static function () {
+			return 'Custom recovery codes title';
+		};
+		add_filter( 'two_factor_backup_codes_download_title', $filter );
+
+		$request = new WP_REST_Request( 'POST', '/' . Two_Factor_Core::REST_NAMESPACE . '/generate-backup-codes' );
+		$request->set_body_params(
+			array(
+				'user_id' => self::$admin_id,
+			)
+		);
+
+		$response = rest_do_request( $request );
+		$data     = $response->get_data();
+
+		remove_filter( 'two_factor_backup_codes_download_title', $filter );
+
+		$this->assertEquals( 200, $response->get_status() );
+		$this->assertStringContainsString( 'Custom recovery codes title', rawurldecode( $data['download_link'] ) );


masteradhoc

Thank you very much for the PR @faithcoder! Here my comments for the PR. We'll await a further review of @georgestephanis and then give you a full feedback.

masteradhoc · 2026-09-09T19:49:44Z

+		/**
+		 * Filters the title in the backup codes download file.
+		 *
+		 * @since 0.17.0
+		 *
+		 * @param string  $title Title for the backup codes download file.
+		 * @param WP_User $user  User for whom the backup codes were generated.
+		 */
+		$title = apply_filters( 'two_factor_backup_codes_download_title', $title, $user );
+


I don't think this filter is really needed. If it is added, applying it to the identifier before sprintf() rather than to the composed string avoids callbacks having to reimplement the translated wrapper.

masteradhoc · 2026-09-09T19:50:10Z

 			/* translators: %s: the site's domain */
 			__( 'Two-Factor Recovery Codes for %s', 'two-factor' ),
-			home_url( '/' )
+			wp_parse_url( home_url(), PHP_URL_HOST )


On a subdirectory multisite all sites share a host, so this labels every site's file identically — home_url( '/' ) at least differed by path.

Fix backup codes site identifier

4b219ad

masteradhoc requested a lite review from Copilot September 7, 2026 16:21

Copilot started reviewing on behalf of masteradhoc September 7, 2026 16:22 View session

Copilot AI reviewed Sep 7, 2026

View reviewed changes

Merge branch 'master' into fix/957-backup-codes-identify-site-by-host

6a26aed

masteradhoc reviewed Sep 9, 2026

View reviewed changes

Navigation Menu

Uh oh!

Use site host in backup codes download title - #964

Use site host in backup codes download title#964
faithcoder wants to merge 2 commits into
WordPress:masterfrom
faithcoder:fix/957-backup-codes-identify-site-by-host

faithcoder commented Aug 25, 2026 •

edited by github-actions Bot

Loading

Uh oh!

github-actions Bot commented Aug 25, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

masteradhoc left a comment

Uh oh!

masteradhoc Sep 9, 2026

Uh oh!

masteradhoc Sep 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

faithcoder commented Aug 25, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What?

Why?

How?

Use of AI Tools

Testing Instructions

Changelog Entry

Uh oh!

github-actions Bot commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

masteradhoc left a comment

Choose a reason for hiding this comment

Uh oh!

masteradhoc Sep 9, 2026

Choose a reason for hiding this comment

Uh oh!

masteradhoc Sep 9, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

faithcoder commented Aug 25, 2026 •

edited by github-actions Bot

Loading

github-actions Bot commented Aug 25, 2026 •

edited

Loading