# Email/IP checks require password
**URL:** https://meta.discourse.org/t/email-ip-checks-require-password/385353
**Category:** Feature
**Tags:** review-queue
**Created:** [October 12, 2025, 3:09am UTC](https://meta.discourse.org/t/email-ip-checks-require-password/385353 "2025-10-12T03:09:12Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@ct-337](https://meta.discourse.org/u/ct-337)
#### Post date: [October 12, 2025, 3:09am UTC](https://meta.discourse.org/t/email-ip-checks-require-password/385353/1 "2025-10-12T03:09:12Z")
When checking someone’s email, IP\[1\], or other sensitive info, you should be required to enter your password so you don’t accidentally check anything.
* * *
1.
> [@Whenever a staff member performs an IP lookup on a user, record the action in the Logs and Screening section](https://meta.discourse.org/t/whenever-a-staff-member-performs-an-ip-lookup-on-a-user-record-the-action-in-the-logs-and-screening-section/383457):
>
> In our forum, we have a few staff members (obviously) that can watch the forum just in case anything bad happens. While I was messing around with the admin controls, I saw an “IP Check” feature. I used it on myself, and it gave me the exact location. I saw that this could be abused, so I went to the Logs and Screening section to see if Discourse itself reports if a staff member has checked someone’s IP. It doesn’t. Here’s a video: Why does Discourse not report it to the Logs? I believe…
---
### Author:  [@mcdanlj](https://meta.discourse.org/u/mcdanlj)
#### Post date: [October 12, 2025, 12:28pm UTC](https://meta.discourse.org/t/email-ip-checks-require-password/385353/2 "2025-10-12T12:28:33Z")
Please no. Making the process of reviewing likely spammers take _even more time_ would be terrible. Spammers already waste so many hours of my life I’ll _never get back_.
If you really want to have to enter your password, create a plugin for it.
---
### Author:  [@Jagster](https://meta.discourse.org/u/Jagster)
#### Post date: [October 12, 2025, 3:36pm UTC](https://meta.discourse.org/t/email-ip-checks-require-password/385353/3 "2025-10-12T15:36:35Z")
Plus email and IP isn’t that sensitive information anyway.
---
### Author:  [@ct-337](https://meta.discourse.org/u/ct-337)
#### Post date: [October 12, 2025, 4:05pm UTC](https://meta.discourse.org/t/email-ip-checks-require-password/385353/4 "2025-10-12T16:05:31Z")
> [@mcdanlj](#):
>
> Spammers already waste so many hours of my life I’ll _never get back_.
you can still block their email and ip without entering a password
> [@Jagster](#):
>
> Plus email and IP isn’t that sensitive information anyway.
on websites with a bunch of immature teens, that info is
---
### Author:  [@mcdanlj](https://meta.discourse.org/u/mcdanlj)
#### Post date: [October 12, 2025, 4:45pm UTC](https://meta.discourse.org/t/email-ip-checks-require-password/385353/5 "2025-10-12T16:45:26Z")
> [@ct-337](#):
>
> you can still block their email and ip without entering a password
You don’t understand my needs here. There are patterns I’m looking for to distinguish likely spammers in nuanced cases.
Asking that every Discourse admin be saddled with this is a huge imposition on others’ time and effort. I am recording here for the record that I am opposed to making this universal.
This is why Discourse has an extensive plug-in ecosystem. You don’t need to impose your ask for additional effort on everyone else.
---
### Author:  [@tobiaseigen](https://meta.discourse.org/u/tobiaseigen)
#### Post date: [October 12, 2025, 7:30pm UTC](https://meta.discourse.org/t/email-ip-checks-require-password/385353/6 "2025-10-12T19:30:07Z")
We have a request for [Add a warning when checking personal messages from a user public profile, as an admin](https://meta.discourse.org/t/add-a-warning-when-checking-personal-messages-from-a-user-public-profile-as-an-admin/215630). Maybe something similar can be done here?