Title: Novelience Password Change Alerts Author: novelience Published: November 3, 2026 Last modified: November 3, 2026 --- Search plugins ![](https://s.w.org/plugins/geopattern-icon/novelience-password-change-alerts.svg) # Novelience Password Change Alerts By [novelience](https://profiles.wordpress.org/novelience/) [Download](https://downloads.wordpress.org/plugin/novelience-password-change-alerts.1.2.3.zip) [Live Preview](https://wordpress.org/plugins/novelience-password-change-alerts/?preview=1) * [Details](https://wordpress.org/plugins/novelience-password-change-alerts/#description) * [Reviews](https://wordpress.org/plugins/novelience-password-change-alerts/#reviews) * [Development](https://wordpress.org/plugins/novelience-password-change-alerts/#developers) [Support](https://wordpress.org/support/plugin/novelience-password-change-alerts/) ## Description Novelience Password Change Alerts observes `wp_set_password` and committed profile_update events. This covers password resets, profile edits through wp_update_user, and updates to existing users through `wp_insert_user`, without a WooCommerce dependency. Email or display-name changes alone do not create an alert, and creating a new user is not treated as a password change. * Never logs, stores, or includes the password in an email. * Deduplicates accidental repeated notifications. * Lets developers filter eligibility, recipient, subject, body, headers, and the deduplication interval. * Fires an action with the final mail result for observability integrations. * Gives each plugin filter and action a separate user-data copy with password hashes and password-reset keys cleared. * Includes French translations for the plugin notice and password-change email; English remains the source language. The extension does not disable WordPress’s own notices. WordPress may also send its standard email for the same update. Changes made directly in SQL or in a custom password store that bypasses these APIs are outside this workflow. Developed and maintained by Novelience. ## FAQ ### Does the email include a sign-in or reset link? No. This avoids placing an account-access link in the same alert channel. ### Can a project customize the message? Yes. Every mail field is filterable, and the wp_password_change_notifier_sent action receives the result and final values. ### How are duplicate events handled? The existing `wp_password_change_notifier_*` filters and cache group remain unchanged. The default cache window is 30 seconds; a persistent object cache can retain it across requests. Setting the window to zero disables that cache suppression, while one core mutation still generates only one plugin alert. When a direct-setter event provides the previous user object, rewriting the same effective credential or rehashing it is ignored. This also covers WordPress-native hashes that normalize leading or trailing whitespace before storage. Older direct-setter events do not expose the previous hash, so an explicit setter or legacy hash upgrade can still be reported. ### How do I migrate an older private Password Change Alerts installation? Deactivate the old `password-change-alerts` copy before activating novelience-password- change-alerts. There is no plugin-owned stored data to migrate or delete. The PHP namespace prevents a function collision if the copies overlap; the new copy removes only the known old password callback for that request and asks an administrator to deactivate the old plugin. Existing filter names and the integer-only deduplication cache remain compatible. The directory slug, folder, main file, and text domain all use novelience-password- change-alerts. ### Which language is used for the alert email? The message uses the WordPress locale active when the password-change hook runs. For example, an administrator’s language can govern an admin request, while a front- end reset normally uses the site’s language. This plugin does not switch to each recipient’s preferred language. If French is the active locale, the bundled French catalog is used without a remote language pack. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Novelience Password Change Alerts” is open source software. The following people have contributed to this plugin. Contributors * [ novelience ](https://profiles.wordpress.org/novelience/) [Translate “Novelience Password Change Alerts” into your language.](https://translate.wordpress.org/projects/wp-plugins/novelience-password-change-alerts) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/novelience-password-change-alerts/), check out the [SVN repository](https://plugins.svn.wordpress.org/novelience-password-change-alerts/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/novelience-password-change-alerts/) by [RSS](https://plugins.trac.wordpress.org/log/novelience-password-change-alerts/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.2.3 * Removed the `load_plugin_textdomain()` call flagged in review. * Registered the bundled French catalog path only for older WordPress versions and affected network activations; Core still loads translations on demand. * Kept WordPress.org language packs ahead of the bundled catalog and retained the 6.3 minimum, existing notification behavior, hooks, and data. #### 1.2.2 * Added bundled French translations for the mail subject, body, and migration notice, plus plugin metadata. * Registered the catalog on `init` so translation loading does not run too early on current WordPress. * Clarified Novelience attribution without listing an individual contact address. * Kept the existing hooks, filters, notification rules, and data handling unchanged. #### 1.2.1 * Aligned the release version with the Novelience catalogue. * Prevented a duplicate alert when a recent WordPress core rewrites the same effective password after normalizing boundary whitespace in its native hash. * Preserved an alert when replacing an older raw MD5 hash changes the effective credential. * Kept existing hooks, filters, and stored data unchanged; no plugin-owned schema or settings migration is required. #### 0.3.1 * Added committed profile/API updates on WordPress 6.3 and newer, without duplicate alerts from overlapping core hooks. * Excluded account creation, unchanged profile fields, and known same-secret setter events. * Cleared password and reset data from separate copies passed to plugin filters and actions. * Added the Novelience name, namespace, directory identity, and a private-installation migration path; existing public filters and cache names remain unchanged. #### 0.3.0 * Added `wp_set_password` handling; profile/API updates on older cores were not yet covered. * Added mail-field filters and delivery-result action. * Removed site-specific wording and completed the English readme. #### 0.2.0 * Initial password reset notification. ## Meta * Version **1.2.3** * Last updated **11 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.3 or higher ** * Tested up to **7.1.4** * PHP version ** 8.2 or higher ** * Tags * [email](https://wordpress.org/plugins/tags/email/)[notification](https://wordpress.org/plugins/tags/notification/) [password](https://wordpress.org/plugins/tags/password/)[security](https://wordpress.org/plugins/tags/security/) * [Advanced View](https://wordpress.org/plugins/novelience-password-change-alerts/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/novelience-password-change-alerts/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/novelience-password-change-alerts/reviews/) ## Contributors * [ novelience ](https://profiles.wordpress.org/novelience/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/novelience-password-change-alerts/)