=== TatarDev Account Alerts ===
Contributors: mitgiselle
Tags: security, notifications, email, users, audit-log
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 8.0
Stable tag: 0.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Configurable email notifications for user account events.

== Description ==

TatarDev Account Alerts emails you when user accounts change. Unlike a
blanket notifier, each event is switched on independently and scoped to the
users you actually care about, by role or by capability.

Events:

* User account created
* Password changed, including resets started from "Lost your password?"
* Email address changed, showing the previous and the new address
* Role changed, showing the previous and the new role
* User account deleted, including deletion from a network's Users screen

For each event you choose the roles it applies to, and optionally a list of
capabilities. An event with no roles and no capabilities selected applies to
every user. Matching considers both sides of a role change, so watching
"Administrator" covers both promotions to and demotions from that role.

Role changes are caught however they are made: by replacing a user's role from
the Users screen, and equally by code that adds a second role to a user or
takes one away without touching the rest.

A "Send test email" button on the settings screen sends a one-off message to
the configured recipients, so you can confirm delivery works before relying
on it.

When several matching events happen in one request — a bulk role change, for
example — you receive a single digest rather than one email per user.

== Installation ==

1. Upload the plugin to `wp-content/plugins/`, or install it from Plugins -> Add New.
2. Activate it.
3. Go to Users -> TatarDev Account Alerts to choose the recipients and which
   events to watch.

Every event starts enabled and scoped to administrators, delivering to the
site's admin email, so an install with no configuration already reports
administrator changes.

== Frequently Asked Questions ==

= When is an email address change reported? =

When it actually takes effect, not when it is requested. Changing your own
email address goes through a confirmation link sent to the new address first;
the change — and this notification — only happens once that link is followed.
An administrator changing someone else's email address takes effect
immediately, with no confirmation step.

= Are capabilities granted with add_cap() reported? =

No. A capability given to one user with add_cap(), rather than through a role,
changes no role and fires no action of its own, so there is nothing to observe
and no role change to report. Role changes themselves are caught whichever
function makes them, add_role() and remove_role() included.

= Does it report deletions on a network install? =

Yes. Deleting an account from Network Admin -> Users is reported, as is
deleting a user from a single site. Removing someone from one site of a network
without deleting their account is not an account deletion and is not reported.

= Can I send to more than one address? =

Yes. The recipients field accepts a comma-separated list.

== Changelog ==

= 0.1.0 =
* Initial release.
