# Make New Users Change Their Password on First Login

> When an administrator creates an account, the new user is sent to their profile and asked to choose a new password before they can use the rest of the site.

- Type: PHP
- Runs: Run everywhere
- Category: [Login](https://wpide.com/library/category/login/)
- Tags: password, login, security
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/force-password-change-first-login/

## Code

```php
add_action( 'user_register', function ( $user_id ) {
    if ( is_admin() && current_user_can( 'create_users' ) ) {
        update_user_meta( $user_id, 'wpide_must_change_password', 1 );
    }
} );

// Changing the password from the profile screen or the reset form clears the flag.
add_action( 'profile_update', function ( $user_id, $old_user ) {
    $user = get_userdata( $user_id );

    if ( $old_user instanceof WP_User && $user && $user->user_pass !== $old_user->user_pass ) {
        delete_user_meta( $user_id, 'wpide_must_change_password' );
    }
}, 10, 2 );
add_action( 'after_password_reset', function ( $user ) {
    delete_user_meta( $user->ID, 'wpide_must_change_password' );
} );

$wpide_needs_new_password = function () {
    if ( ! is_user_logged_in() || wp_doing_ajax() || ( defined( 'REST_REQUEST' ) && REST_REQUEST ) ) {
        return false;
    }

    return (bool) get_user_meta( get_current_user_id(), 'wpide_must_change_password', true );
};

add_action( 'admin_init', function () use ( $wpide_needs_new_password ) {
    global $pagenow;

    if ( 'profile.php' !== $pagenow && $wpide_needs_new_password() ) {
        wp_safe_redirect( admin_url( 'profile.php#password' ) );
        exit;
    }
} );

add_action( 'template_redirect', function () use ( $wpide_needs_new_password ) {
    if ( $wpide_needs_new_password() ) {
        wp_safe_redirect( admin_url( 'profile.php#password' ) );
        exit;
    }
} );

add_action( 'admin_notices', function () use ( $wpide_needs_new_password ) {
    if ( $wpide_needs_new_password() ) {
        echo '<div class="notice notice-warning"><p><strong>Please choose a new password</strong> under "Account Management" below before continuing.</p></div>';
    }
} );
```

## Notes

Applies to accounts created by administrators from now on, not to self-registrations or existing users.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Make New Users Change Their Password on First Login" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/