I am having difficulty understanding why user security and validation is so vague in WP (4.0).. Surely email verification should come as default?

Anyway I have been trying to find a solution to user security. All I can seem to find are plugins that send email validation links on registration. This is great, however a user can the log in and just change the email to foo@par.com no questions asked. Either a) I now have an unverified user; or b) Someone has just hijacked the account.

Surely I am missing something here, these features predate WordPress so there must be a solution?

Edit: Just to clarify, I want a confirmation email sent to the OLD email address - ie "someone, probably you has tried to change the email associated with this account..". As opposed to just verifying an email address for validity

  • possible duplicate of Confirmation required on email change – cybmeta Sep 13 '14 at 12:40
  • Doesn't work with current version and there may be a plugin solution however I guess updated answers should go on the other post – Andy Sep 13 '14 at 13:17
  • I updated my question for clarity, the "possible duplicate" thread doesn't cover part b) of my question :) – Andy Sep 15 '14 at 1:57
  • I think it does, have you tried it?. Anyway, show us your effort to solve the problem and post the code you have tried, working or not, to avoid "do the job for me" format. – cybmeta Sep 15 '14 at 8:25

You can use this hook to send a mail to your old email address

add_action( 'profile_update', 'my_profile_update', 10, 2 );

    function my_profile_update( $user_id, $old_user_data ) {
       //Load new user data by uid and  compare with old data
           // Email code about profile changes 

I think this should work for you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.