WordPress new sign-in email: tell people when they sign in elsewhere
A WordPress new sign-in email tells a person, by email, that their own account has just signed in from a network it has not used before. BetterShield calls the setting Tell account holders about sign-ins from a new network. It goes to the person whose account it is, because they are the one who knows whether the sign-in was them, and it blocks nothing.
The site’s alert list already hears about what happens on the site, as our guide to WordPress security email alerts explains. This post covers the other direction: one short note to each account holder about their own account, what it contains, and who it suits.
Quick summary
- Tell account holders about sign-ins from a new network emails the account’s own address the first time it signs in from a network it has not used before.
- It is off by default, and it blocks nothing. The sign-in goes ahead either way.
- It sends at most one email per account per day, however many new networks the account signs in from.
- It never shows a whole address. The email gives the first part of the address and hides the last.
- Undo it by turning the switch off and pressing Save.
Why tell the account holder
An administrator can read the activity log and see a sign-in from somewhere unusual. What they cannot see is whether it was a colleague on a new phone or someone who should not be there. The account holder can tell in a second.
That is the whole idea. The email asks one person one question about one account, and it says plainly that a new office, a phone on mobile data or a trip needs nothing from them. A sign-in they did not make is the one email they will act on.
What it does
- On each successful sign-in, BetterShield compares the network the sign-in came from with the networks the account signed in from before. A network here is the first part of an address: the /24 for IPv4 and the /64 for IPv6, in the terms of CIDR notation.
- It looks at the account’s “Signed in” records that the activity log still holds, which is 30 days, or 90 with Ultra, up to the 50 most recent networks.
- A new network sends an email to the account’s own email address.
- At most one email per account per day. The activity log records Signed in from a new network every time, including the days the email is skipped.
- No email for the first sign-in on record, for example on the day you install BetterShield, because there is nothing to compare it with.
- Every role receives it: administrators, writers, store customers and members alike.
- Safe mode sends none, and neither does a connection BetterShield cannot verify.
What the email says
The email is short. It uses the plugin’s own wording, and you can see it all by sending yourself one.
| Part | What it says |
|---|---|
| Subject | “[Site name] Your account signed in from a new place” |
| Opening line | Someone signed in to your account on the site from an internet connection you haven’t used there before. |
| When and where | The date and time, and the internet address with its last part hidden, for example 203.0.113.x. |
| If it was not you | “Not you? Change your password now and check your signed-in devices”, with a link. |
| If it was | “If this was you, no action needed. We send at most one of these emails a day.” |
The link goes to the person’s profile, where Where you are signed in lists their devices (see Sessions and Your profile). A store customer who cannot reach the dashboard is sent to Sign-in security on My Account instead.
Set it up
- Open BetterShield › Protection › Login & Access.
- Under Sign-in protection, turn on Tell account holders about sign-ins from a new network.
- Press Save.
| Option | What it does | Default |
|---|---|---|
| Tell account holders about sign-ins from a new network | Emails the account holder the first time their account signs in from a network it has not used before, at most once a day. Blocks nothing. | Off |
Before you turn it on, check that How this site sees you reads that automatic lockouts are active. Like the lockouts, the email needs connections BetterShield can verify. Behind a proxy it cannot see through, it sends nothing. Our guide to getting the real visitor IP behind a proxy and the Proxies and Cloudflare doc cover that.
What it keeps about people
The network is the only thing the email and the log keep about where a sign-in came from. BetterShield never stores a whole address: it keeps the first three groups of an IPv4 address, or the first four of an IPv6 address.
The activity rows behind the comparison are kept for the log’s retention, and WordPress’s own Export Personal Data and Erase Personal Data tools handle them. An erasure keeps the row but takes the person’s name and network out of it. The personal data doc has the full table, and BetterShield adds suggested text for your privacy policy under Settings › Privacy › Policy Guide.
What it can break, and how to undo
- More email to more people. It writes to people who are not the site’s administrator, which is why it is off by default. Someone who travels or moves between mobile networks may hear from it most days, never more than once a day.
- Questions. A person who gets one may ask you what it means. The email itself says that a new office, phone or trip needs nothing from them.
- It depends on your site’s email. If the site cannot send mail, nobody hears anything. The Email alerts doc shows how to check delivery.
To stop it, turn the switch off and press Save. With password confirmation on, that asks for your password. Nothing else changes, and no account is affected.
Check it is working
- The activity log records Signed in from a new network for each new network, rated Medium.
- A test. With the switch on, sign in once as a test account from your usual connection, then sign in again from a phone on mobile data. The test account’s inbox receives the email.
If nothing arrives, check the site’s outgoing mail first, then whether the second sign-in was really from a different network. A phone on the same Wi-Fi is not a new network.
Recommended settings
We recommend turning it on where the people who sign in are staff.
| Site | What we recommend |
|---|---|
| Blog or brochure site | On. |
| Store (WooCommerce) | Leave it off unless you want every customer to receive these emails too. If you turn it on, tell customers first. |
| Membership or course site | The same as a store: members are emailed as well. |
| Agency or many sites | On for client sites where only staff sign in. |
It pairs well with the activity log, which keeps the record for you, while the email asks the person involved.
Frequently asked questions
Does a new sign-in email block the sign-in?
No. The sign-in has already succeeded when the email is sent. The setting only tells the account holder, so the person can change their password and sign out their devices if it was not them.
Who receives it, the administrator or the account holder?
The account holder, at the account’s own email address. It does not go to the site’s alert list. If you also want those messages, set up the alerts described in Email alerts.
How often will someone get it?
At most once a day per account, however many new networks the account signs in from. The activity log still records each one.
Why did a new account get no email on its first sign-in?
There was nothing to compare it with. The email only goes out once the account has a sign-in on record from a different network.
Does it show the person’s full IP address?
No. The email shows the address with its last part hidden, and BetterShield stores only the network.
Conclusion
A new sign-in email puts one question in front of the one person who can answer it. It is off by default, it blocks nothing and it sends at most once a day. BetterShield is free on WordPress.org; the full details are in the new-network sign-in email doc.