I am having difficulty understanding why user security and validation is so vague in WP (4.0).. Surely email verification should come as default?

Anyway I have been trying to find a solution to user security. All I can seem to find are plugins that send email validation links on registration. This is great, however a user can the log in and just change the email to [email protected] no questions asked. Either a) I now have an unverified user; or b) Someone has just hijacked the account.

Surely I am missing something here, these features predate WordPress so there must be a solution?

Edit: Just to clarify, I want a confirmation email sent to the OLD email address - ie "someone, probably you has tried to change the email associated with this account..". As opposed to just verifying an email address for validity

  • possible duplicate of Confirmation required on email change
    – cybmeta
    Sep 13, 2014 at 12:40
  • Doesn't work with current version and there may be a plugin solution however I guess updated answers should go on the other post
    – Andy
    Sep 13, 2014 at 13:17
  • I updated my question for clarity, the "possible duplicate" thread doesn't cover part b) of my question :)
    – Andy
    Sep 15, 2014 at 1:57
  • I think it does, have you tried it?. Anyway, show us your effort to solve the problem and post the code you have tried, working or not, to avoid "do the job for me" format.
    – cybmeta
    Sep 15, 2014 at 8:25

1 Answer 1


You can use this hook to send a mail to your old email address

add_action( 'profile_update', 'my_profile_update', 10, 2 );

    function my_profile_update( $user_id, $old_user_data ) {
       //Load new user data by uid and  compare with old data
           // Email code about profile changes 

I think this should work for you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.