EffortLess Multisite Change Username

Description

WordPress does not let you edit the login name (user_login) of an account. This plugin adds one admin page that changes it for any user, together with the public name fields. You pick the user by login name, email address or user ID (a login that is only digits is tried as a login before it is read as an ID); leaving the box empty selects your own account. The user ID is not touched, so posts, roles, email address, password and other user meta stay attached to the account.

The page edits these fields of the selected user:

• Login username (user_login)
• Email address (user_email)
• Author URL slug (user_nicename)
• Public display name (display_name)
• Nickname
• First name
• Last name

The login name is written first with a single $wpdb->update() on the row of the selected user’s ID, because core has no function for it, and the user cache is cleared around it. The super admin list follows, then the profile fields are saved with wp_update_user(). If a later step fails, the earlier ones are put back, so a failed save leaves the account as it was. If you rename the account you are signed in with, a new authentication cookie is issued for the same user ID so your current session is not ended. Other users’ sessions end, because authentication cookies contain the login name.

On Multisite, a username is stored once for the whole network, so a rename applies to every site and the page is available only to super admins. On a single site it is available to users with the manage_options capability. If the old login name is listed in the network’s super admin list (site_admins), the list is updated to the new name. If that update fails, the old login name is written back and nothing is changed.

Settings and fields

• Login username – 3 to 60 bytes. Must pass WordPress validate_username(), must not already belong to another account and must not appear in the illegal_user_logins filter or, on Multisite, in the network’s “Banned Names” list. On Multisite the rules WordPress applies to new network users also apply to a changed login: at least 4 characters, lowercase letters and numbers only, not only numbers, and not reserved by a pending sign-up from the last two days. A login you leave unchanged is not checked against these rules.
• Email address – must be a valid address not used by another account. On Multisite a changed address must also pass the network’s “Banned Email Domains” and “Limited Email Registrations” settings and must not be reserved by a pending sign-up. It is saved at once, without the confirmation email WordPress sends when users change their own address. A checkbox (off by default) sends WordPress’s notice about the change to the previous address.
• Administration email – optional checkbox, off by default. When ticked and the email changes, the administration email is replaced with the new address if it equals the old one, ignoring letter case. On a single site this is the email in Settings > General. On Multisite, Network Admin replaces only the network administration email (Network Settings); a site’s own screen replaces the network email and that site’s email. Other sites of a network are not changed. The value is saved at once, without the confirmation email WordPress normally sends for this setting.
• Author URL slug – up to 50 bytes. Converted with sanitize_title(). Must not be used by another account. This is the part of the author archive URL (/author/slug/); links to the old slug stop working unless you add a redirect.
• Public display name – required, up to 250 bytes.
• Nickname – required.
• First name / Last name – optional.
• Other copies of the old login – optional checkbox, off by default. When ticked and the login changes, the author URL slug, display name and nickname are replaced with the new login if they still equal the old one. Unticked, they keep the values shown in the form.
• Your current password – required. This is the password of the account you are signed in with, not of the renamed user. It is checked with wp_check_password() before anything is changed. It is not stored and not changed. After 5 wrong passwords the page refuses further attempts from that account for 15 minutes.
• Backup confirmation checkbox – required. The form is not processed without it.

Notes and limitations

• On Multisite the change applies to every site, because the user table is shared. There is no per-site login name.
• Other plugins can react to a rename with the elmcu_login_changed action (arguments: user ID, old login, new login).
• Other plugins that store the login name as text (security plugins, allow lists, external services, single sign-on) are not updated and may need to be changed by hand.
• The plugin stores no options and creates no database tables. Deleting it leaves the renamed account as it is.
• The page sends no emails, except the optional notice to the previous address when you tick that checkbox.
• After an error the values you typed are shown again for 5 minutes (the password and the backup checkbox are not kept).

External services

This plugin does not connect to any external service. The “Support the development” notice on the plugin page contains a link to https://id7.dev/donate/ that opens only when you click it.