0

We recently had an employee leave our company. When they left, I changed all their passwords and removed their email access etc. I also changed the password on our Wordpress site for the Admin login, and the primary email to my own. But I didn't change my own email password.

Yesterday, I received two emails from Wordpress saying that there had been a password reset request. One of the emails had been clicked on (you can tell this in Gmail) and the password to our Wordpress had been changed. I immediately changed it back again and then changed my own email password.

Is there any way I can track who requested that password change, and who accessed my email. (We use Gmail through Google Apps here)?

I have my suspicions it was our old employee as she could have found my password and made a note of it before leaving. But I can't tell what she did in Wordpress when she was in there, and if in fact it was her.

Thanks for your help.

  • 2
    Anything email related is far out of the scope of WordPress Answers. There is no way within WP to see who requested an admin password reset. – vancoder Apr 29 '13 at 23:18
  • 2
    If you're asking retroactively, then no it is not possible. If you're asking how to detect it if it happens again in the future, yes it is possible, but some code will need to be written. Please modify your answer to clarify which question you intended, as both have very, very different answers – Tom J Nowell Apr 29 '13 at 23:55
  • Thanks for your comments. I am asking retroactively, so it looks like it is not possible. However, now that it has happened once, be good to know who it was next time if it happens again. Is it hard to get hands on the code? – Teresa Apr 30 '13 at 4:07
2

You could log all attempts to get the lost password email:

add_action( 'retrieve_password', 'log_password_requests' );

function log_password_requests( $user_name_or_email )
{
    // save the user name or email plus the IP address in an option
}
1

If you are able to access server logs (e.g. Apache), then you can search the access.log for all requests to wp-login.php?action=lostpassword. You might be able to identify the IP address from which the request originated. But otherwise, WordPress does not maintain an audit log which would indicate who requested the change.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.