WordPress’s built-in admin-email verification screen—shown every few months since version 5.3—breaks Playwright automation that updates plugins on sites without SSH access. The extra step forces scripts to wait for a button that never appears, causing timeouts and stalled deployments.
What triggers the stall
When a Playwright script logs into wp-admin it expects the dashboard to load immediately. Instead, WordPress sometimes redirects to a page whose URL contains adminhash=. The page asks, “Is this still your address?” with two buttons: Yes, this is my address and I’ll wait. A human clicks “I’ll wait” and proceeds later; an unattended script keeps looking for the dashboard’s elements, never finds them, and eventually times out.
Why the prompt exists
WordPress added the prompt to confirm that the admin email address is still reachable. It appears roughly every few months, regardless of site activity, and is intended as a security check for site owners who might have lost access to the address.
Who is affected
- Developers who rely on Playwright to push plugin updates, run UI tests, or perform bulk admin tasks.
- Hosting providers that restrict SSH, forcing users to automate through the browser.
- Site owners who see delayed updates because the automation never reaches the update screen.
The cost is not just a wasted few seconds; repeated failures can halt scheduled maintenance windows and force manual intervention.
Detecting the unwanted screen
The presence of adminhash= in the current URL is a reliable indicator. The string appears only on the email-verification page, not on the regular dashboard or any other admin screen.
A simple bypass
Insert a check right after the login step. If the URL contains adminhash=, click the “I’ll wait” button and wait for the page to settle before continuing.
def ensure_past_email_check(page):
if "adminhash=" in page.url:
page.click("text=I'll wait")
page.wait_for_load_state("networkidle")
Call ensure_past_email_check(page) immediately after every successful login. The function does nothing when the verification screen does not appear, keeping the script fast and deterministic.
When to use the bypass
For automated workflows that must run without human supervision—such as nightly plugin updates or continuous-integration UI tests—the bypass is practical. It treats the verification step as a predictable detour rather than a random failure.
Counter-point
Some administrators argue that automatically dismissing the prompt could mask a genuine email-delivery problem. If the admin email truly becomes unreachable, the site may miss critical notifications. In such cases, a more nuanced approach—logging the event, sending an alert, or pausing the automation—might be preferable.
What to watch next
- WordPress could change the URL pattern or add additional verification steps, which would break the
adminhash=check. Keep an eye on core release notes. - Playwright’s selector engine evolves; ensure the text selector
"text=I'll wait"continues to match the button after any UI redesign. - If you manage many sites, consider centralising the bypass logic in a shared library to avoid duplicated code.
By explicitly handling the admin-email confirmation page, developers turn an occasional timeout into a routine part of their Playwright scripts, keeping WordPress automation reliable even when the platform throws in an unexpected security prompt.