Password Reset Page
Help users quickly and securely reset their passwords with a well-designed password reset experience.

Password reset form styling inherits from login customization
Overview
WordPress includes a built-in password reset system. When users forget their passwords, they request a reset link via email. BuddyX Pro lets you customize how the password reset form looks to match your login page branding.
How Password Reset Works
The User Journey
- User clicks “Lost your password?” on the login page
- Enters their username or email on the reset form
- Receives an email with a password reset link
- Clicks the link in the email
- Enters a new password on the reset page
- Logs in with the new password
What You Can Customize
BuddyX Pro provides customization options for the visual appearance of the password reset form, which inherits most styling from your login page settings.
Customization Options
Password Reset Form Styling
When you enable custom login in BuddyX Pro, the password reset page automatically uses your login page theme. You can further customize the “Lost Password” form specifically.
Location: Appearance → Customize → Site Settings → Login Customization → Forget Form
| Setting | Description | Requirement |
|---|---|---|
| Background Image | Custom background for reset form | Form Transparency must be OFF |
| Background Color | Solid color background | Form Transparency must be OFF |
Note: These settings only appear when:
- Enable Custom Login is turned ON
- Choose Theme is enabled
- Enable Form Transparency is turned OFF
Inherited Settings
The password reset form automatically inherits these styles from your login page:
From Login Form Settings:
- Form width
- Form minimum height
- Form border radius
- Form shadow and shadow opacity
- Form padding
- Input field styling (background, text, border colors)
- Input field dimensions
- Label colors and sizes
- Link colors
From Button Settings:
- Button background and border colors
- Button hover states
- Button text colors
- Button dimensions and padding
- Button border radius and shadow
From Background Settings:
- Page background (image, color, or video)
- Background gallery selection
This means you typically don’t need to configure the password reset form separately—it automatically matches your login page design.
Configuration Examples
Example 1: Distinct Reset Form
Create a visually different password reset form to help users understand they’re on a different page.
Settings:
- Background Image: Upload a distinct image (e.g., lock icon, security theme)
- Background Color: Leave empty or use complementary color
Use Case: When you want users to clearly know they’re resetting their password, not logging in.
Example 2: Consistent Branding
Keep the reset form identical to the login form for brand consistency.
Settings:
- Leave Background Image and Background Color empty
- Form automatically uses login page styling
Use Case: Maintain seamless brand experience across all authentication pages.
Example 3: High Security Feel
Emphasize security on the password reset page.
Settings:
- Background Image: Security-themed image (shield, lock, key)
- Background Color: Darker shade of your brand color
Use Case: Financial services, healthcare, or any security-sensitive application.
Password Reset Email
While BuddyX Pro customizes the visual appearance of the reset form, WordPress handles the password reset email. You can customize these emails using plugins or code.
Default Email Content
WordPress sends a plain-text email containing:
- Site name
- Username
- Password reset link (expires in 24 hours)
- Login URL
- Note that the email was automatically generated
Customizing Reset Emails
To customize the password reset email, you have several options:
Option 1: Email Customizer Plugins
Use plugins designed for WordPress email customization:
WP Mail SMTP
- Customize email sender name and address
- Add logo to emails
- Style with HTML templates
Email Templates by Kadence WP
- Visual email designer
- Pre-built templates
- Custom branding
BuddyPress (if installed)
- Built-in email customizer
- Navigate to Settings → BuddyPress → Emails
- Customize all BuddyPress-related emails
Option 2: Custom Code
Add to your child theme’s functions.php or a custom plugin:
/**
* Customize password reset email subject
*/
add_filter( 'retrieve_password_title', function( $title, $user_login, $user_data ) {
return sprintf( '[%s] Reset Your Password', get_bloginfo( 'name' ) );
}, 10, 3 );
/**
* Customize password reset email message
*/
add_filter( 'retrieve_password_message', function( $message, $key, $user_login, $user_data ) {
$message = sprintf( __( 'Hello %s,' ), $user_login ) . "\r\n\r\n";
$message .= __( 'Someone requested a password reset for your account. If this was you, click the link below:' ) . "\r\n\r\n";
$message .= network_site_url( "wp-login.php?action=rp&key=$key&login=" . rawurlencode( $user_login ), 'login' ) . "\r\n\r\n";
$message .= __( 'If you did not request this, please ignore this email.' ) . "\r\n\r\n";
$message .= sprintf( __( 'Thanks, %s Team' ), get_bloginfo( 'name' ) ) . "\r\n";
return $message;
}, 10, 4 );
Option 3: HTML Email Templates
For styled HTML emails, use this code:
/**
* Send password reset email as HTML
*/
add_filter( 'wp_mail_content_type', function( $content_type ) {
if ( did_action( 'retrieve_password' ) ) {
return 'text/html';
}
return $content_type;
} );
/**
* Customize HTML password reset email
*/
add_filter( 'retrieve_password_message', function( $message, $key, $user_login, $user_data ) {
$reset_url = network_site_url( "wp-login.php?action=rp&key=$key&login=" . rawurlencode( $user_login ), 'login' );
ob_start();
?>
Password Reset Request
Hello ,
Someone requested a password reset for your account on .
If you did not request this, please ignore this email. The link expires in 24 hours.
This email was sent from
Email Best Practices
Subject Line:
- Keep it clear and action-oriented
- Include site name for recognition
- Example: “[YourSite] Password Reset Request”
Email Body:
- Greet user by username
- Explain what happened (someone requested reset)
- Provide clear call-to-action button/link
- Mention link expiration (24 hours)
- Add security note (ignore if not you)
- Include site name/branding
Sender Information:
- Use recognizable sender name (your site name)
- Use professional email address (not wordpress@yoursite.com)
- Configure via Settings → General or email plugin
Security Considerations
Built-in WordPress Security
WordPress password reset includes several security features:
Rate Limiting:
- Limits password reset requests
- Prevents spam/abuse
Time Expiration:
- Reset links expire in 24 hours
- Links become invalid after use
Unique Keys:
- Each reset link is unique
- Cannot be reused or guessed
User Verification:
- Requires valid username or email
- Sends link only to registered email
Additional Security
Enhance password reset security:
1. Two-Factor Authentication Use plugins like:
- Two-Factor
- WP 2FA
- Google Authenticator
2. Password Strength Requirements Enforce strong passwords:
add_filter( 'password_hint', function( $hint ) {
return 'Password must be at least 12 characters with uppercase, lowercase, numbers, and symbols.';
} );
3. Login Attempt Limiting Use plugins like:
- Limit Login Attempts Reloaded
- WP Cerber Security
4. reCAPTCHA Protection Add reCAPTCHA to password reset:
- Google reCAPTCHA
- Advanced noCaptcha & invisible Captcha
5. Security Logging Monitor password reset activity:
- WP Activity Log
- Simple History
- WP Security Audit Log
Warning Signs to Monitor
Watch for these suspicious activities:
- Multiple reset requests from same IP
- Reset requests for admin accounts
- Unusual time patterns (middle of night)
- Mass reset requests across multiple accounts
Use security plugins to alert you to these patterns.
Common Questions
Why don’t I see separate password reset settings?
Password reset form styling is controlled by your login page settings. Specific “Forget Form” settings only appear when:
- Custom login is enabled
- You’re using a pre-designed theme (Choose Theme ON)
- Form transparency is disabled
Most customization happens automatically through login page inheritance.
Can I redirect users after password reset?
Yes, using custom code:
add_filter( 'login_redirect', function( $redirect_to, $requested_redirect_to, $user ) {
// Check if this is after password reset
if ( isset( $_GET['password'] ) && $_GET['password'] === 'changed' ) {
return home_url( '/welcome/' );
}
return $redirect_to;
}, 10, 3 );
How do I change the password reset link expiration?
WordPress default is 24 hours. To modify:
add_filter( 'password_reset_expiration', function() {
return DAY_IN_SECONDS; // 24 hours (default)
// return HOUR_IN_SECONDS * 2; // 2 hours
// return DAY_IN_SECONDS * 2; // 48 hours
} );
Security note: Shorter expiration is more secure.
Users aren’t receiving reset emails
Common issues and solutions:
1. Email not configured properly
- Install WP Mail SMTP plugin
- Configure with your email provider
- Test email sending
2. Spam folder
- Check user’s spam/junk folder
- Configure SPF/DKIM records
- Use authenticated email service
3. Server email blocking
- Contact hosting provider
- May need to use transactional email service (SendGrid, Mailgun)
4. Incorrect email address
- Verify user’s email in Users admin
- Update if incorrect
5. Plugin conflict
- Temporarily disable security plugins
- Check if they’re blocking password resets
Can I require additional verification?
Yes, through custom code or plugins. Example with security question:
// Add custom field to password reset form
add_action( 'lostpassword_form', function() {
echo '';
echo '';
echo '
';
} );
// Verify security question
add_action( 'lostpassword_post', function( $errors ) {
if ( empty( $_POST['security_answer'] ) ) {
$errors->add( 'invalid_security', __( 'Please answer the security question.' ) );
}
// Add your verification logic here
// Compare with stored answer in user meta
} );
How do I track password reset activity?
Use a security logging plugin or custom code:
add_action( 'after_password_reset', function( $user, $new_pass ) {
// Log password reset
error_log( sprintf(
'Password reset for user: %s (ID: %d) at %s',
$user->user_login,
$user->ID,
current_time( 'mysql' )
) );
// Or save to custom table, send admin notification, etc.
}, 10, 2 );
Can I customize the “Lost your password?” link?
Yes, using CSS or hooks:
Change link text:
add_filter( 'gettext', function( $translated_text, $text, $domain ) {
if ( $text === 'Lost your password?' ) {
return 'Forgot password?';
}
return $translated_text;
}, 10, 3 );
Change link styling:
body.login #nav a {
color: #your-color;
font-weight: bold;
}
body.login #nav a:hover {
color: #your-hover-color;
}
Does this work with custom user roles?
Yes. WordPress password reset works for all user roles (subscriber, contributor, author, editor, administrator). However:
- Some security plugins may disable admin password reset
- Custom roles need proper capabilities
- Multi-site has additional considerations
Can I add password reset to a custom page?
Yes, using a password reset form plugin or shortcode:
Option 1: Use a Plugin
- Theme My Login
- WP User Frontend
- Ultimate Member
Option 2: Custom Shortcode
add_shortcode( 'custom_password_reset', function() {
if ( is_user_logged_in() ) {
return 'You are already logged in.
';
}
ob_start();
?>
Use with: [custompasswordreset]
What happens if the reset link is clicked twice?
WordPress invalidates the reset key after first use for security. If clicked again, the user sees an error message and must request a new reset link.
Advanced Customization
Custom Password Reset Page Template
Create a custom template for the password reset experience:
- Create
page-password-reset.phpin your child theme - Add custom HTML and styling
- Use WordPress password reset functions
- Create a page and assign this template
Multi-Site Considerations
For WordPress Multi-Site networks:
// Customize password reset for network
add_filter( 'retrieve_password_title', function( $title, $user_login, $user_data ) {
$site_name = get_network()->site_name;
return sprintf( '[%s] Password Reset', $site_name );
}, 10, 3 );
// Send from network admin email
add_filter( 'wp_mail_from', function( $email ) {
if ( did_action( 'retrieve_password' ) ) {
return get_network_option( null, 'admin_email' );
}
return $email;
} );
Integration with BuddyPress
If using BuddyPress, leverage its email customizer:
- Go to Settings → BuddyPress → Emails
- Find password reset related emails
- Customize with visual editor
- Add BuddyPress tokens for personalization
Testing Your Password Reset
Before going live, thoroughly test:
Test Checklist:
- Request password reset with valid username
- Request password reset with valid email
- Try invalid username/email (should show generic message)
- Check email arrives quickly (within 1-2 minutes)
- Verify email formatting and links work
- Click reset link and set new password
- Confirm old password no longer works
- Verify new password works for login
- Test link expiration (wait 24+ hours)
- Test link reuse (should fail after first use)
- Test on mobile devices
- Check spam folder delivery
Email Testing Tools:
- Mail Tester (mail-tester.com)
- GlockApps
- Email on Acid
Related Settings
- Login Page Branding – Customize the login page
- Registration Page Branding – Customize registration
- Email Settings – General email configuration
- Security Settings – Site security options
Support
Need help with password reset customization?
- Documentation: BuddyX Pro Documentation
- WordPress Support: WordPress Forums
- Theme Support: Support Portal
- Email: support@wbcomdesigns.com
Before contacting support:
- Test password reset with multiple user accounts
- Check email delivery logs
- Verify SMTP configuration
- Test with default theme to rule out conflicts
- Provide email headers if emails aren’t delivering
- Share screenshots of any error messages
