# Ask for the Current Password Before Changing Email or Password

> Adds a "Current password" field to the profile screen and refuses changes to your own email address or password unless it is correct, so someone using an unattended logged-in browser cannot take over the account.

- Type: PHP
- Runs: Admin only
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: passwords, profile, account-takeover
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/sec-current-password-for-account-changes/

## Code

```php
add_action( 'show_user_profile', function () {
    echo '<h2>Confirm changes</h2><table class="form-table" role="presentation"><tr><th><label for="wpide-current-pass">Current password</label></th><td><input type="password" name="wpide_current_pass" id="wpide-current-pass" class="regular-text" autocomplete="current-password"><p class="description">Required to change your email address or password.</p></td></tr></table>';
} );

add_action( 'user_profile_update_errors', function ( $errors, $update, $user ) {
    if ( ! $update || empty( $user->ID ) || get_current_user_id() !== (int) $user->ID ) {
        return;
    }

    $current = get_userdata( $user->ID );
    $changes = ( ! empty( $user->user_pass ) ) || ( isset( $user->user_email ) && strtolower( $user->user_email ) !== strtolower( $current->user_email ) );

    if ( ! $changes ) {
        return;
    }

    $given = isset( $_POST['wpide_current_pass'] ) ? (string) wp_unslash( $_POST['wpide_current_pass'] ) : '';

    if ( '' === $given || ! wp_check_password( $given, $current->user_pass, $current->ID ) ) {
        $errors->add( 'wpide_current_pass', '<strong>Error:</strong> Enter your current password to change your email address or password.' );
    }
}, 10, 3 );
```

## Notes

Applies only when users edit their own profile; administrators editing other users are not asked.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Ask for the Current Password Before Changing Email or Password" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/