WordPress 4.3 emails new users a link to set their own password instead of the password itself. Test that your site's email arrives, give everyone their own login, and expect menus and a site icon in the Customizer.

What arrived yesterday

WordPress 4.3 came out yesterday, Tuesday. Security releases install themselves on most sites, but a major version like this one waits for someone to click update.

Most of the changes are small and sensible: menus in the Customizer, a setting for the icon in browser tabs, typing shortcuts in the editor and comments switched off on new pages.

One change will catch people out. WordPress no longer emails passwords. New users, and anyone who resets a password, get a link instead, and that link has to arrive.

What staff will notice

The first breaks an old habit. For years, adding a login meant WordPress emailed the password, and owners often passed it on by text message or sticky note as well.

Why the emailed password had to go

A password sent by email sits in an inbox indefinitely: forwarded, synced to phones and kept in the sent folder of whoever passed it on.

Anyone who later gets into that mailbox finds a working login to the website, often an administrator's, and many people never change a password they were sent.

A link to set your own password means only the person using the login knows it. WordPress 4.3 also emails users when their password or email address changes, so an unexpected change gets noticed.

The link only works if the email arrives

The welcome email and the reset link are sent by the website itself, often straight from the web server, which receiving mail systems tend to treat with suspicion.

If your domain's records do not list the web server as an allowed sender, those messages land in spam or disappear.

Before 4.3 the password itself was in the email. Now the email carries the only link a new user is given, and if it never arrives, they cannot get in without help.

Test it this week: create a login for yourself at a different address, and see whether the email arrives and where. If it fails, have the site send mail through an authenticated mail account on your own domain.

A strong password, and what people do with it

The suggested password is long and random: much harder to guess, and much harder to remember or type on a phone.

Some people will replace it with something weaker, and WordPress will warn them. Others will keep it and stick it to the monitor, or reuse it everywhere.

The answer is a password manager on each computer and phone, and a separate login for each person, with the role they need: author or editor for staff who post, administrator only for the owner and whoever maintains the site.

A worked example

A bridge club runs afternoon and evening games five days a week in a rented hall, with beginner lessons in spring and fall, and volunteers post each game's results to the club's website.

The volunteers shared one administrator login, whose password a past president had emailed to each new helper.

The site was updated to 4.3 yesterday afternoon, and a login was added for a member taking over the evening results this week. The email with the link went straight to the spam folder on her phone.

Whoever looks after the site moved its mail to the club's own mail account, so messages pass the domain's checks, then tested the welcome email with addresses at three providers.

Each volunteer now has an author login of their own. The shared account is gone, and so are the old emails containing its password.

Menus in the Customizer

Menus can now be built in the Customizer, the panel that previews changes before visitors see them, which helps anyone nervous about breaking the navigation.

The old menu screen under Appearance is still there. Some themes and plugins add options to menu items that may only appear on that screen for now, so look there if an option seems to have vanished.

The site icon

The site icon setting, under Site Identity in the Customizer, sets the small image in browser tabs and bookmarks, and on a phone's home screen when someone saves the site there.

It needs a square image at least 512 pixels on each side. A wide logo will not fit, so use a symbol or an initial that reads at a tiny size.

If the theme already sets an icon, manage it in one place. The new setting stays when the theme changes, which makes it the better home.

Shortcuts and comments

The editor now formats as you type. An asterisk or hyphen and a space at the start of a line begins a bulleted list, 1 and a full stop begins a numbered one, and number signs make a heading.

Staff who type numbered steps by hand will see them become a list; pressing undo straight away should reverse it.

New pages have comments off by default. Older pages keep their settings, so check them for comment forms collecting spam nobody reads.

The counter-case

A site with one administrator, no staff logins and reliable mail will notice little beyond the icon setting.

There is also no need to update within the hour. Waiting a few days while plugin makers confirm compatibility is reasonable, provided someone takes a backup and updates soon rather than in months.

For everyone else, prepare for the password change: test the site's email, give each person their own login, and stop sending passwords by any route.

This week

  1. Back up the site before updating to 4.3.
  2. Check your plugins support the new version.
  3. Test the welcome email with a new login.
  4. Fix how the site sends mail if it fails.
  5. Give each person their own login and role.
  6. Remove shared administrator accounts.
  7. Add a square site icon.

Step three should be done today. Every other change in 4.3 shows on screen, but a welcome email sitting in a spam folder fails silently until someone cannot log in.

Old mail settings expose passwords in another way, described in email settings that send passwords in plain text.

Frequently asked questions

What changed with passwords in WordPress 4.3?

WordPress no longer emails passwords. New users and anyone resetting a password receive a link to set their own, and reset links expire after a day.

Why would a new user never get in?

Because the welcome email with the link may land in spam or vanish if the site sends mail from the web server without passing the domain checks.

How do I test the welcome email?

Create a login for yourself at a different address and check whether the email arrives, how quickly it comes, and which folder it lands in.

Should staff share one administrator login?

No. Use separate logins, one per person, each limited to the role it needs. Store passwords in a password manager, and keep administrator access for the owner and the site's maintainer.

What size should the site icon be?

Square and at least 512 pixels on each side. A wide logo will not fit, so use a simple symbol or initial that reads at a tiny size.

Will 4.3 install itself automatically?

Usually not. Security releases update automatically on most sites, but a major version like 4.3 waits for someone to back up the site and click update.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Staff sharing one WordPress login?

Tell us where your site lives. We will set up a separate login for each person and check that its emails arrive.

Start a Conversation