Search code examples
wordpresschange-password

Password reset link generation for protected pages in Wordpress

I want to make a password reset functionality for protected pages in Wordpress for non logged in users.

The email of these people is stored in our database, and the page has a default random password.

Based on their e-mail address which they type in in a login form, if that email address is found in our database, they would receive an email with a reset link to that email address, which would point to a password reset page, where they could do the change.

Is this possible in Wordpress in a way that is secure too. How would I go about it?

Solution

  • Yes it is possible using the below 15 steps...

    1. Create password reset page with input for user email address

    2. Post user email address to same page

    3. Query database table to to verify email address belongs to a registered user

    4. Create random string of characters, recommended 32 characters long

    5. Store random string in database table

    6. Create password reset URL

    7. Password reset URL should direct to password reset page on your site

    8. Include the random string as a query parameter in the password reset URL

    9. Include the user email address as a query parameter in the password reset URL

    10. Email password reset URL link to user

    11. When user click on the password reset URL link it will open the password reset page

    12. Capture the random string and user email query parameters

    13. Query database table to to verify email address belongs to a registered user

    14. Crosscheck the the random string query parameter associated with the verified email address against the value stored in step 5

    15. If match, proceed to allow user to change password value