WordPress.org
Get WordPress
WordPress.org

WordPress Developer Resources

wp_password_change_notification()

wp_password_change_notification( WP_User $user )

In this article

Back to top

Notifies the blog admin of a user changing password, normally via email.

Parameters

$userWP_Userrequired
User object.

More Information

  • This function is normally called when a user resets a lost password, not if the password is changed on their profile page.
  • This function can be replaced via plugins. If plugins do not redefine these functions, then this will be used instead.

Source

function wp_password_change_notification( $user ) {
	/*
	 * Send a copy of password change notification to the admin,
	 * but check to see if it's the admin whose password we're changing, and skip this.
	 */
	if ( 0 !== strcasecmp( $user->user_email, get_option( 'admin_email' ) ) ) {

		$admin_user = get_user_by( 'email', get_option( 'admin_email' ) );

		if ( $admin_user ) {
			$switched_locale = switch_to_user_locale( $admin_user->ID );
		} else {
			$switched_locale = switch_to_locale( get_locale() );
		}

		/* translators: %s: User name. */
		$message = sprintf( __( 'Password changed for user: %s' ), $user->user_login ) . "\r\n";
		/*
		 * The blogname option is escaped with esc_html() on the way into the database in sanitize_option().
		 * We want to reverse this for the plain text arena of emails.
		 */
		$blogname = wp_specialchars_decode( get_option( 'blogname' ), ENT_QUOTES );

		$wp_password_change_notification_email = array(
			'to'      => get_option( 'admin_email' ),
			/* translators: Password change notification email subject. %s: Site title. */
			'subject' => __( '[%s] Password Changed' ),
			'message' => $message,
			'headers' => '',
		);

		/**
		 * Filters the contents of the password change notification email sent to the site admin.
		 *
		 * @since 4.9.0
		 *
		 * @param array   $wp_password_change_notification_email {
		 *     Used to build wp_mail().
		 *
		 *     @type string $to      The intended recipient - site admin email address.
		 *     @type string $subject The subject of the email.
		 *     @type string $message The body of the email.
		 *     @type string $headers The headers of the email.
		 * }
		 * @param WP_User $user     User object for user whose password was changed.
		 * @param string  $blogname The site title.
		 */
		$wp_password_change_notification_email = apply_filters( 'wp_password_change_notification_email', $wp_password_change_notification_email, $user, $blogname );

		wp_mail(
			$wp_password_change_notification_email['to'],
			wp_specialchars_decode( sprintf( $wp_password_change_notification_email['subject'], $blogname ) ),
			$wp_password_change_notification_email['message'],
			$wp_password_change_notification_email['headers']
		);

		if ( $switched_locale ) {
			restore_previous_locale();
		}
	}
}

View all references View on Trac View on GitHub

Hooks

apply_filters( ‘wp_password_change_notification_email’, array $wp_password_change_notification_email, WP_User $user, string $blogname )

Filters the contents of the password change notification email sent to the site admin.

UsesDescription
wp_specialchars_decode()wp-includes/formatting.php

Converts a number of HTML entities into their special characters.

get_user_by()wp-includes/pluggable.php

Retrieves user info by a given field.

wp_mail()wp-includes/pluggable.php

Sends an email, similar to PHP’s mail function.

apply_filters()wp-includes/plugin.php

Calls the callback functions that have been added to a filter hook.

get_option()wp-includes/option.php

Retrieves an option value based on an option name.

Show 2 moreShow less

Changelog

VersionDescription
2.7.0Introduced.

User Contributed Notes

  1. Skip to note 5 content
    Creative Andrew
    You must log in to vote on the helpfulness of this noteVote results for this note: 2You must log in to vote on the helpfulness of this note

    The function is hooked to the 'after_password_reset' action, so I think a simpler way to disable it would be just:

    remove_action( 'after_password_reset', 'wp_password_change_notification' );
  2. Skip to note 6 content
    Chengmin
    You must log in to vote on the helpfulness of this noteVote results for this note: 1You must log in to vote on the helpfulness of this note

    By default, WordPress sends a notification to the blog admin whenever a user changed the password.
    To disable this just add below code to your theme or plugin.

    if ( ! function_exists( 'wp_password_change_notification' ) ) :
    function wp_password_change_notification( $user ) {
        return;
    }
endif;
  3. Skip to note 7 content
    FixItDik
    You must log in to vote on the helpfulness of this noteVote results for this note: 1You must log in to vote on the helpfulness of this note

    Alternative method to prevent these emails being sent, put the following code in your functions.php file of your theme or plugin:

    // disable the email notification to admin when user changes password
add_filter( 'wp_password_change_notification_email', 'wpdocs_stop_email' );
function wpdocs_stop_email( $email ) {
	$email['to'] = ''; //empty the TO: part, will fail to send
	return $email;
}

    (I found rsm0128’s suggestion did not work for me in WordPress 6.0)

You must log in before being able to contribute a note or feedback.