[Someone Keeps Triggering WordPress Password Reset on My Site. So I Killed It]
Got a bunch of these emails this morning.
“Password reset request for your account.” Over and over. From my own site. I didn’t ask for them. Someone—or something—was poking the “lost password” button on piall.com.
Annoying? Yes. Scary? Not really. At least not after I looked closer.
Here’s the thing. WordPress sends that email when anyone types in a valid username or email address. It doesn’t mean they got in. It just means they know your site exists. Which, you know, is public anyway.
So I did what most people would do: I panicked for about three seconds. Then I checked stuff.
Admin password? Fine. Email password? Changed it anyway, why not. Backup email? Oh yeah, that exists. Changed that too. Two-factor? Already on. Any weird admin accounts in the dashboard? None. Files look clean. xmlrpc.php? Blocked that ages ago.
So the door was locked. They were just knocking. Loudly.
Also, the IP address in that reset email? Useless. I use Cloudflare. That IP is probably just a proxy node. Could be the attacker, could be some random CDN edge. No way to tell. So I stopped caring about that after two minutes.
I could have gone down a rabbit hole. Hide /wp-admin/. Add a captcha to the login page. Rename the admin user. Set up some fancy Cloudflare WAF rule. All good ideas. But honestly? I’m lazy. And my blog is tiny. I’m the only person who ever logs in.
Why do I even need a password reset feature?
I don’t.
So I added one line to my theme’s functions.php:
add_filter(‘allow_password_reset’, ‘__return_false’);
That’s it. That’s the whole fix.
Now when someone—or some bot—tries to use the reset form, they get a message: “Password reset is not allowed for this user.” No more emails. No more noise. Done in 30 seconds.
But wait, I should back up. Why did this happen in the first place? WordPress is too helpful. It ships with a bunch of endpoints wide open. /wp-login.php, /wp-admin/, xmlrpc.php, and yes, the password reset endpoint. Bots scan for these 24/7. It’s not personal. It’s just the internet being the internet.
I’m not saying WordPress is bad. I’ve used it for years. But the defaults are designed for everyone, which means they’re also designed for bots. You have to close the doors you don’t need.
Also, my cat walked across my keyboard while I was testing the fix. She managed to type “asdf” into the login field. Not relevant. But it happened. And now you know.
I thought about doing more. Maybe hiding the login page would be smarter. But I don’t think it’s necessary for a blog that gets maybe 50 visitors a day. And I already have a strong password and 2FA. The reset button was the only open invite.
To be fair, I might be overcomplicating this. Maybe I should just ignore those emails and move on. But they bug me. And it took less time to disable the feature than it would take to delete all those emails over the next few weeks.
Oh, and I should mention—my VPS is only $6 a month. Nothing fancy. It runs Redis for caching and Nginx for the web server. But that’s a story for another day.
If you’re running a WordPress site and you’re the only user, do yourself a favor: turn off password resets. You don’t need them. If you ever forget your password, you can always enable it temporarily, reset, then turn it off again. It’s not rocket science.
I’m not 100% sure I’m doing this right. Maybe there’s a better way. But for now, the noise stopped. And I’m happy with that.
I’ll keep it like this for a while. Might add a WAF rule later. Or not. We’ll see.
Anyway, that’s what I did. Took me about 15 minutes total. Most of that was double-checking things I already knew. If anything changes, I’ll post an update. But I doubt it.
Now go close your own open doors. Or don’t. Your call.
