Remove/Block Forgot Password Page

external=wordpress should only be available if “Hide WordPress logins” is enabled; “Disable WordPress logins” should prevent that login method from working. So at least the attackers shouldn’t be able to log into an account if they manage to intercept the “reset password” email.

But it does make sense to disable the forgot password endpoint if WordPress logins are disabled. We’ll look at the wp-login.php source and see if there’s a good way to do that!

For now you should be able to just hook into lostpassword_errors and return a WP_Error object which will abort the password reset process (it won’t send any emails):

https://developer.www.ads-software.com/reference/hooks/lostpassword_errors/

Aloha, the next release of Authorizer will include blocking access to the reset password form if Authorizer is configured to “Disable WordPress Logins”:

https://github.com/uhm-coe/authorizer/commit/7f982fe0579cc254e168ec14d31c180d3871f165

Thanks!

Excellent! Thank you ??