How to Fix WordPress Password Reset Not Working
If the WordPress password reset link is not arriving or the reset form keeps failing, the problem is usually in email delivery, site configuration, or account access.
This guide explains the most reliable fixes so you can restore password recovery without guesswork.
How WordPress Password Reset Normally Works
When a user requests a reset, WordPress generates a time-limited token, stores it in the database, and sends a reset email using the site’s mail system.
If any step fails, the recovery flow breaks before the user can set a new password.
The issue may involve WordPress core, the active theme, a plugin conflict, a mail deliverability problem, or an incorrect site URL.
In many cases, the account is still intact and only the reset process is blocked.
Check Whether the Reset Email Is Being Sent
The fastest way to narrow the problem is to determine whether WordPress is generating the email at all.
Request a reset for a valid username or email address, then inspect the inbox, spam folder, and server mail logs if available.
- Confirm the account email address exists in the Users section.
- Check spam, junk, promotions, and quarantine folders.
- Use a temporary mail logging plugin to verify whether WordPress triggers the message.
- Test with a second email provider such as Gmail, Outlook, or Yahoo.
If no message is logged, the issue is likely in WordPress, a plugin, or the server mail setup.
If the message is logged but never arrives, the problem is usually deliverability.
Fix Email Delivery Issues
WordPress uses PHP mail by default on many hosts, and that method is often unreliable.
A properly configured SMTP service usually improves delivery and reduces the chance of password reset emails being blocked.
Use an SMTP plugin
Install a trusted SMTP plugin such as WP Mail SMTP or Post SMTP, then connect it to a mail service like SendGrid, Mailgun, Amazon SES, or your hosting provider’s authenticated SMTP server.
This routes password reset emails through a verified sender instead of anonymous server mail.
Verify sender details
Make sure the site’s From address matches a domain you control.
Mismatched sender domains, missing SPF records, or missing DKIM signatures can cause password reset mail to be rejected by Gmail and other providers.
Check hosting restrictions
Some managed WordPress hosts disable or limit PHP mail, especially on shared infrastructure.
Review your host’s documentation or support panel to confirm whether outgoing mail is supported and whether rate limits apply.
Confirm the Site URL and Email Settings
Incorrect WordPress URL settings can interfere with reset links or direct users to the wrong domain.
Review the WordPress Address and Site Address values under Settings to ensure they match the real site location, including the correct protocol and domain.
If you migrated from HTTP to HTTPS or changed domains, stale URLs in the database can also affect password reset behavior.
In addition, confirm that user profile email addresses are current, especially for administrators and editors who may need recovery access.
Disable Conflicting Plugins and Test Again
Security, login, membership, and email-related plugins are common causes of password reset failures.
A plugin may block the reset request, alter the login form, or rewrite the reset email template in a way that breaks token validation.
To test safely, deactivate nonessential plugins one by one and retry the reset flow after each change.
Pay close attention to security plugins such as Wordfence, iThemes Security, Sucuri, or login rate-limiting tools, as they may block password-related requests.
- Deactivate caching plugins temporarily.
- Disable security and login protection plugins.
- Turn off membership or custom registration plugins.
- Test with a default theme such as Twenty Twenty-Four if needed.
Clear Cache and Cookie Problems
Browser cache, page cache, and object cache can interfere with login and reset pages.
If the reset link loads an outdated form or the login page keeps looping, clear all layers of cache and try a private browser window.
If you use a CDN such as Cloudflare, purge the cache there as well.
Some setups cache the login page or block query-string parameters in reset links, which prevents the token from being recognized.
Reset the Password Manually in the Database
If the email system is down and you need immediate access, you can reset the account directly in the database or through hosting tools.
This is often the quickest emergency fix for administrators with no working email path.
Common recovery options include phpMyAdmin, your hosting control panel, or a database management tool provided by your server.
Update the user’s password with a secure hash or use the host’s built-in password reset function if available.
- Back up the database before making changes.
- Find the correct user record in the wp_users table.
- Set a new password using a secure method supported by your host.
- Log in and immediately update email and security settings.
For multisite installs, confirm you are editing the correct user and site context, since permissions and user mapping can behave differently from a single-site installation.
Inspect Security Rules, Firewalls, and Rate Limits
Web application firewalls and brute-force protection can block password reset requests if they detect unusual traffic or repeated attempts.
This is common when a site is under attack, when a user keeps retrying the form, or when the server flags requests from certain regions or IP ranges.
Review logs from Cloudflare, Sucuri, Wordfence, your host, or your server firewall.
If a rule is blocking the reset endpoint, whitelist the route or temporarily relax the rule set while you test the process.
Check for Corrupted Core Files
Although less common, broken WordPress core files can cause login and password features to fail.
If other admin functions behave unexpectedly, reinstall the current WordPress core version from the dashboard or via a fresh package upload while preserving wp-content and wp-config.php.
This step can repair missing login templates or damaged authentication files without affecting posts, pages, or media.
Always create a backup first, especially on production sites.
Use a Reliable Troubleshooting Order
When you are trying to fix WordPress password reset not working, follow a simple order so you do not waste time guessing.
Start with email delivery, then move to plugin conflicts, then check site settings and server restrictions.
- Test the reset request and check spam folders.
- Switch to SMTP and verify sender authentication.
- Deactivate security, cache, and membership plugins.
- Confirm WordPress URLs and user email addresses.
- Clear all caches and retest in a private browser.
- Reset the password manually if access is still blocked.
Prevent Password Reset Problems in the Future
Once access is restored, reduce the chance of repeat failures by improving your site’s mail reliability and login setup.
Use authenticated SMTP, keep plugins updated, and avoid stacking multiple security tools that overlap in function.
It also helps to store administrator recovery emails in a monitored inbox, use strong passwords, and test account recovery after major changes such as migrations, domain switches, or hosting moves.
A simple quarterly check can reveal broken mail delivery before it becomes an emergency.