Description
Novelience Password Change Alerts observes wp_set_password and committed
profile_update events. This covers password resets, profile edits through
wp_update_user, and updates to existing users through wp_insert_user,
without a WooCommerce dependency. Email or display-name changes alone do not
create an alert, and creating a new user is not treated as a password change.
- Never logs, stores, or includes the password in an email.
- Deduplicates accidental repeated notifications.
- Lets developers filter eligibility, recipient, subject, body, headers, and
the deduplication interval. - Fires an action with the final mail result for observability integrations.
- Gives each plugin filter and action a separate user-data copy with password
hashes and password-reset keys cleared. - Includes French translations for the plugin notice and password-change email;
English remains the source language.
The extension does not disable WordPress’s own notices. WordPress may also send
its standard email for the same update. Changes made directly in SQL or in a
custom password store that bypasses these APIs are outside this workflow.
Developed and maintained by Novelience.
FAQ
-
Does the email include a sign-in or reset link?
-
No. This avoids placing an account-access link in the same alert channel.
-
Can a project customize the message?
-
Yes. Every mail field is filterable, and the
wp_password_change_notifier_sent action receives the result and final values. -
How are duplicate events handled?
-
The existing
wp_password_change_notifier_*filters and cache group remain
unchanged. The default cache window is 30 seconds; a persistent object cache
can retain it across requests. Setting the window to zero disables that cache
suppression, while one core mutation still generates only one plugin alert.
When a direct-setter event provides the previous user object, rewriting the
same effective credential or rehashing it is ignored. This also covers
WordPress-native hashes that normalize leading or trailing whitespace before
storage. Older direct-setter events do not expose the previous hash, so an
explicit setter or legacy hash upgrade can still be reported. -
How do I migrate an older private Password Change Alerts installation?
-
Deactivate the old
password-change-alertscopy before activating
novelience-password-change-alerts. There is no plugin-owned stored data to
migrate or delete. The PHP namespace prevents a function collision if the
copies overlap; the new copy removes only the known old password callback for
that request and asks an administrator to deactivate the old plugin. Existing
filter names and the integer-only deduplication cache remain compatible.The directory slug, folder, main file, and text domain all use
novelience-password-change-alerts. -
Which language is used for the alert email?
-
The message uses the WordPress locale active when the password-change hook runs.
For example, an administrator’s language can govern an admin request, while a
front-end reset normally uses the site’s language. This plugin does not switch
to each recipient’s preferred language. If French is the active locale,
the bundled French catalog is used without a remote language pack.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Novelience Password Change Alerts” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Novelience Password Change Alerts” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.2.3
- Removed the
load_plugin_textdomain()call flagged in review. - Registered the bundled French catalog path only for older WordPress versions and affected network activations; Core still loads translations on demand.
- Kept WordPress.org language packs ahead of the bundled catalog and retained the 6.3 minimum, existing notification behavior, hooks, and data.
1.2.2
- Added bundled French translations for the mail subject, body, and migration notice, plus plugin metadata.
- Registered the catalog on
initso translation loading does not run too early on current WordPress. - Clarified Novelience attribution without listing an individual contact address.
- Kept the existing hooks, filters, notification rules, and data handling unchanged.
1.2.1
- Aligned the release version with the Novelience catalogue.
- Prevented a duplicate alert when a recent WordPress core rewrites the same effective password after normalizing boundary whitespace in its native hash.
- Preserved an alert when replacing an older raw MD5 hash changes the effective credential.
- Kept existing hooks, filters, and stored data unchanged; no plugin-owned schema or settings migration is required.
0.3.1
- Added committed profile/API updates on WordPress 6.3 and newer, without duplicate alerts from overlapping core hooks.
- Excluded account creation, unchanged profile fields, and known same-secret setter events.
- Cleared password and reset data from separate copies passed to plugin filters and actions.
- Added the Novelience name, namespace, directory identity, and a private-installation migration path; existing public filters and cache names remain unchanged.
0.3.0
- Added
wp_set_passwordhandling; profile/API updates on older cores were not yet covered. - Added mail-field filters and delivery-result action.
- Removed site-specific wording and completed the English readme.
0.2.0
- Initial password reset notification.