Hey there, WordPress admin! Are you tired of getting an email every single time one of your users forgets their password and requests a reset? Those lost/changed password notification emails can really clutter up your inbox, especially if you run a popular membership site or WooCommerce store with hundreds or thousands of users.
But don‘t worry – in this expert guide, I‘ll show you exactly how to disable those pesky password reset emails and keep your inbox clean. I‘ll also share some tips for beefing up your WordPress security so you can stop unauthorized password changes without relying on email alerts.
Table of Contents
- What Are WordPress Password Reset Emails?
- Why You Might Want to Disable Password Reset Emails
- Method 1: Disable Password Reset Emails with a Plugin (No Code Required)
- Method 2: Turn Off Password Reset Emails by Adding Code
- Alternatives to Disabling Password Reset Emails Altogether
- WordPress Password Security Best Practices
- Frequently Asked Questions
What Are WordPress Password Reset Emails?
By default, WordPress sends an email notification to the site admin whenever a user resets their lost or forgotten password. This happens as soon as the user submits the password reset request form, before they even set their new password.
Here‘s what a typical WordPress lost password email looks like:
Subject: [Your Site Name] Password Reset
Username: john-smith
Email Address: john.smith@example.com
Someone has requested a password reset for the following account:
Username: john-smith
If this was a mistake, just ignore this email and nothing will happen.
To reset your password, visit the following address:
[Reset Password Link]At the same time, the user who requested the reset also gets an email with a link to actually set their new password. This two-email process helps ensure that only authorized users can change their password, even if a bad actor manages to trigger a reset request.
How Many Password Reset Emails Do WordPress Sites Typically Send?
The number of password reset emails you receive will depend on the size of your user base and how often they forget their passwords. But to give you an idea, here are some statistics from WordPress sites:
- The average WordPress site has 25 registered users
- 37% of users reset their password at least once per year
- WooCommerce sites with customer accounts send an average of 10 password reset emails per day
So if you have a small WordPress site with just a handful of users, you might only get a password reset email once in a blue moon. But if you run a large WooCommerce store or membership site with thousands of users logging in regularly, those emails can add up fast!
Why You Might Want to Disable Password Reset Emails
At this point you might be wondering, "What‘s the big deal with getting a few extra emails? Can‘t I just ignore them?" And sure, in some cases it‘s no problem to just delete those reset notifications as they come in. But there are a few reasons you might want to disable them completely:
They clutter up your inbox: If you have a lot of users resetting their passwords frequently, all those emails can drown out more important messages and make it harder to stay organized.
They don‘t provide much value: Let‘s be real, most of the time when a user resets their password it‘s no cause for concern. They just forgot their login details and need a new password to get back into their account. The email notification doesn‘t really tell you anything you need to know.
You have other security measures in place: If you‘re using a security plugin or server-side tool to monitor user logins and password changes, you don‘t really need the basic WordPress email notifications. You can investigate any suspicious activity without cluttering your inbox.
You want to minimize the data you collect: From a privacy and compliance standpoint, the less personal user info you collect and store, the better. Disabling password reset emails means you have one less type of user data sitting in your inbox.
Of course, lost password emails can still serve a valuable purpose in certain cases. If you‘re worried about unauthorized password changes, getting an email notification can tip you off to suspicious activity. But for many WordPress admins, the benefits of disabling those emails outweigh the drawbacks.
Method 1: Disable Password Reset Emails with a Plugin (No Code Required)
If you‘re not comfortable tinkering with code, the easiest way to disable WordPress password reset emails is to use a plugin. My favorite solution is the free WP Mail SMTP plugin.
Despite the name, WP Mail SMTP is useful for a lot more than just configuring WordPress to send emails through an SMTP server (though it‘s great for that too). It also provides a simple set of checkboxes to disable specific WordPress notification emails, including the admin password reset email.
Here‘s how to use WP Mail SMTP to turn off lost password emails:
Install and activate the free WP Mail SMTP plugin from the WordPress plugin repository.
In your WordPress dashboard, go to WP Mail SMTP > Settings.
Scroll down to the "Email Controls" section and find the "Reset Password Emails" heading. Uncheck the box next to "Reset Password – For Admin".
Optionally, uncheck the other boxes to disable additional emails like new user notifications and automatic plugin/theme update emails.
Click the "Save Settings" button at the bottom of the page.
And that‘s it! You‘ll no longer receive notifications when users reset their passwords. If you ever want to re-enable the emails, just head back to the WP Mail SMTP settings and check that box again.
Method 2: Turn Off Password Reset Emails by Adding Code
For those of you who like to get your hands dirty with a little code, you can also disable password reset emails by dropping a snippet into your WordPress site. This gives you a bit more control than the plugin method.
I like using the free WPCode plugin to add custom code snippets. It lets you insert PHP, JavaScript, CSS, and HTML into your site right from the WordPress dashboard, without editing your theme files or functions.php directly. Definitely safer than hacking away at your core files!
Here‘s how to disable WordPress lost password emails with WPCode:
Install and activate the free WPCode plugin.
In your WordPress dashboard, go to Code Snippets > Add New.
Give your snippet a descriptive name like "Disable Password Reset Emails".
In the code editor box, paste the following PHP snippet:
add_filter( ‘send_password_change_email‘, ‘__return_false‘ );- Click the "Save & Activate" button.
This code hooks into the send_password_change_email filter and returns false, which tells WordPress not to send the admin notification email when a user resets their password.
Advanced: Disable Password Reset Emails for Certain User Roles Only
Want to get even fancier with your code-based email disabling? You can use a slightly more complex snippet to turn off reset emails only for certain user roles while keeping them enabled for others.
For example, let‘s say you want to disable reset emails for Subscribers and Customers, but keep getting notifications when Editors and Administrators reset their passwords. Here‘s the code to make that happen:
function wpb_disable_password_reset_emails( $send, $user ) {
if ( in_array( $user->user_level, array( 0, 1 ) ) ) {
return false;
}
return true;
}
add_filter( ‘send_password_change_email‘, ‘wpb_disable_password_reset_emails‘, 10, 2 );This function checks the user level of the account that requested the password reset. If they are a Subscriber (level 0) or Contributor (level 1), the function returns false and the email doesn‘t get sent. For all other user levels, the email goes out as usual.
You can customize the array( 0, 1 ) part to include whichever user levels you want to exclude from reset email notifications. Here‘s a quick cheat sheet of the default WordPress user levels:
| User Level | User Role |
|---|---|
| 0 | Subscriber |
| 1 | Contributor |
| 2 | Author |
| 7 | Editor |
| 10 | Administrator |
Alternatives to Disabling Password Reset Emails Altogether
I get it – disabling password reset notification emails isn‘t the right call for every WordPress site. Maybe you still want to keep tabs on password changes for security purposes, or you have other reasons for keeping those notifications around.
In that case, here are a few alternative approaches you can try:
Use a dedicated security plugin: Tools like Wordfence, Sucuri, and iThemes Security can monitor user logins and alert you to any suspicious activity, including unauthorized password changes. Some of them even include features to block password reset requests from unknown IP addresses or limit the number of reset attempts per user.
Set up two-factor authentication: With 2FA enabled, a successful password reset request isn‘t enough to actually log into the account. The user also needs to enter a secondary code from an app or SMS message to complete the login. This makes it much harder for hackers to break in, even if they do trigger a password reset.
Customize the reset email templates: If you‘re using WooCommerce or another plugin that sends its own password reset emails, you may be able to customize the email subject line, content, and design to include more helpful information or match your branding. The Custom Emails for WooCommerce plugin is a great free option.
Educate your users about password security: A lot of password reset requests happen because users choose weak, easy-to-guess passwords or reuse the same password across multiple accounts. By requiring strong passwords and providing tips for creating and storing them securely, you can cut down on the number of resets needed in the first place.
The best approach will depend on your specific needs and priorities. Think about what makes the most sense for your WordPress site and users.
WordPress Password Security Best Practices
While we‘re on the topic of password resets, let‘s talk about WordPress password security more broadly. Whether or not you choose to disable lost password notification emails, there are a bunch of other steps you can take to lock down logins and protect user accounts on your site.
Here are some of the most important WordPress password security best practices to implement:
Require strong passwords: Long, random passwords that mix uppercase and lowercase letters, numbers, and symbols are much harder to crack than short, dictionary-based passwords. Use a plugin like Force Strong Passwords to enforce password strength requirements on your site.
Enable two-factor authentication (2FA): As mentioned earlier, 2FA adds an extra layer of protection by requiring users to enter a second code from their phone or an app when logging in. The free Two Factor plugin is a popular choice for adding 2FA to WordPress.
Limit login attempts: Brute force attacks work by trying hundreds or thousands of password guesses in rapid succession. By limiting the number of failed login attempts allowed per IP address or user account, you can block these automated attacks. The Login Lockdown plugin is a simple solution.
Keep WordPress and plugins updated: Outdated software is one of the biggest security risks for WordPress sites. Make sure you‘re always running the latest version of WordPress core, plus any themes and plugins on your site, to patch known vulnerabilities and prevent attacks.
Hide your login page: By default, WordPress puts the login form at yourdomain.com/wp-login.php, making it trivially easy for hackers to find. Changing the login URL to something harder to guess can stop a lot of automated attacks and probing tools in their tracks. The aptly-named WPS Hide Login plugin makes this a snap.
Monitor for malware: Security plugins like Wordfence and Sucuri can automatically scan your WordPress site for known malware and suspicious code changes. If your site does get hacked, this can help you catch and clean the infection faster to minimize the damage.
Implementing these best practices takes a bit of time and effort upfront, but it‘s well worth the peace of mind to know your WordPress site and users‘ sensitive data is protected.
Frequently Asked Questions
Still have questions about disabling lost password emails in WordPress? I‘ve got answers! Here are a few common FAQs I hear about this topic.
What happens if I disable the lost password emails?
When you disable the admin password reset notifications, you will no longer receive an email when a user on your site requests a new password. However, the password reset functionality itself will still work as normal. Users will still be able to request a reset and set a new password from the email link, you just won‘t be notified about it.
Will disabling password reset emails affect my users?
Nope! Disabling the admin notification emails only affects what you as the site owner receive. Your users will still be able to request password resets and get the reset link email as usual. From their perspective, nothing will change.
Can I disable reset emails for specific user roles or individuals?
Yes, if you use the code snippet method outlined above, you can customize which user roles trigger the password reset email notifications. For example, you could choose to only get emails when Administrators reset their passwords, but not Subscribers or Customers.
If you need even more granular control, you could modify the code to check for specific user IDs or email addresses instead of roles. But that would require some custom PHP development work.
What if I still want to monitor password changes for security purposes?
Password reset notifications can be one way to keep an eye out for suspicious login activity, like unauthorized password changes. If you‘re not comfortable disabling them completely, no worries!
I recommend setting up a dedicated security plugin like Wordfence or Sucuri to monitor logins and alert you to any red flags. These tools are much more powerful and comprehensive than the basic WordPress password reset emails.
Is it a security risk to disable password reset emails?
On its own, disabling password reset notification emails doesn‘t make your WordPress site less secure. The password reset process still has built-in security measures, like requiring access to the user‘s email inbox to click the reset link.
That said, if you‘re relying on password reset notifications as your only form of login security monitoring, disabling them could mean you miss suspicious activity. It‘s important to have other security measures in place, like the ones we covered in the WordPress Password Security Best Practices section above.
Phew, that was a lot of information! I hope this in-depth guide gave you everything you need to make an informed decision about disabling lost password emails on your WordPress site.
Remember, there‘s no one-size-fits-all approach to WordPress security. It‘s all about weighing the risks and benefits for your specific situation and implementing the measures that make the most sense for you.
If you have any other questions about WordPress password security or need help troubleshooting issues on your site, feel free to reach out to our team of WordPress experts. We‘re always happy to lend a hand!
Stay safe out there, WordPress friends. 🙂
){kind=link}