I would like to track when a user changes their password. Is there a way to detect when a password has been changed?
2
-
WordPress already does this. You'll get an email when the password is changed.– chrisguitarguyMay 7, 2012 at 3:15
-
I have never received an email when another user changed their password.– Chad SnowMay 7, 2012 at 4:30
Add a comment
|
1 Answer
WordPress sends an email to the admin's email when a user resets their password.
To get a notification when a user changes their password you could hook into the profile_update action which is fired when a user's profile is updated.
When the action is fired WordPress has already validated and updated the user's details we only need to check if the user submitted a password with the request, if it was submitted then the user's password has changed.
function my_profile_update( $user_id ) {
if ( ! isset( $_POST['pass1'] ) || '' == $_POST['pass1'] ) {
return;
}
// password changed...
}
add_action( 'profile_update', 'my_profile_update' );
-
Shouldn't the
ifstatement be like this:if ( ! isset( $_POST['pass1'] ) || '' != $_POST['pass1'] ) {– GiraldiMay 18, 2013 at 7:46 -
@gmaggio , no because the first
ifverifies if the password is changed and if the password isn't null. Both must be false. if the second is'' != $_POST['pass1']any password, not empty will return TRUE– EekSep 13, 2013 at 13:08 -
Just a note that if anyone's trying to do this with the Profile Builder / Profile Builder Pro plugins, their password fields have an extra 'w', i.e.
$_POST['passw1']Also note you don't need to check if the password is valid / the passwords don't match, because if there's a problemprofile_updatewon't run. Jan 31, 2015 at 21:09 -
2For a more accurate assesment if the users password was changed, you should do a check to make sure that
$_POST['pass1'] === $_POST['pass2']because if the user had entered the wrong text into one of the inputs, then the page would still be submitted, however their password would not actually change. Most likely they would make another attempt, and this check would prevent false or double notification. Feb 4, 2015 at 22:21