# Email Alerts When Application Passwords Are Created

> Emails the user and the site administrator whenever a new application password is created for an account, since these passwords give API access that bypasses the normal login.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: application-passwords, alerts, api
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/sec-application-password-alerts/

## Code

```php
add_action( 'wp_create_application_password', function ( $user_id, $item ) {
    $user = get_userdata( $user_id );

    if ( ! $user ) {
        return;
    }

    $site    = wp_specialchars_decode( get_bloginfo( 'name' ), ENT_QUOTES );
    $actor   = wp_get_current_user();
    $message = sprintf(
        "A new application password named \"%s\" was created for the account %s.\n\nCreated by: %s\nIP address: %s\nTime: %s\n\nIf this was not expected, revoke it under Users > Profile > Application Passwords and change the account password.",
        isset( $item['name'] ) ? $item['name'] : '',
        $user->user_login,
        $actor->exists() ? $actor->user_login : 'unknown',
        isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '',
        wp_date( 'Y-m-d H:i' )
    );

    $recipients = array_unique( array( $user->user_email, get_option( 'admin_email' ) ) );
    wp_mail( $recipients, sprintf( '[%s] New application password', $site ), $message );
}, 10, 2 );
```

## Notes

Application passwords created by the user themselves also trigger the email, which doubles as a receipt.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Email Alerts When Application Passwords Are Created" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/