Alert the Site Owner When an Administrator's Email or Password Changes
Emails the site's admin address whenever any administrator account changes its email address or password, a key warning sign of an account takeover.
Opens WPIDE on
Code
add_action( 'profile_update', function ( $user_id, $old_data ) {
$user = get_userdata( $user_id );
if ( ! $user || ! $old_data || ! user_can( $user, 'manage_options' ) ) {
return;
}
$changes = array();
if ( $user->user_email !== $old_data->user_email ) {
$changes[] = sprintf( 'email changed from %s to %s', $old_data->user_email, $user->user_email );
}
if ( $user->user_pass !== $old_data->user_pass ) {
$changes[] = 'password changed';
}
if ( ! $changes ) {
return;
}
$actor = wp_get_current_user();
wp_mail(
get_option( 'admin_email' ),
sprintf( '[%s] Administrator account changed', wp_specialchars_decode( get_bloginfo( 'name' ), ENT_QUOTES ) ),
sprintf(
"The administrator account \"%s\" was changed: %s.\n\nChanged by: %s\nIP address: %s\nTime: %s",
$user->user_login,
implode( ', ', $changes ),
$actor->exists() ? $actor->user_login : 'password reset or system',
isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '',
wp_date( 'Y-m-d H:i' )
)
);
}, 10, 2 );Notes
WordPress already notifies the affected user; this adds a second notice to the site owner.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.