How to Disable Password Reset in WordPress (and Hide the Lost Password Link)

Updated October 2026 by Marius: rewritten for current WordPress and tested on WordPress 7.1. Originally published by Hardeep Asrani in 2014.

The “Lost your password?” link on the WordPress login page and the password reset behind it are two separate things. Removing the link only hides it: anyone can still open wp-login.php?action=lostpassword and request a reset email. To actually turn the feature off, use the allow_password_reset filter. The snippets below cover both, for all users or for administrators only.

Disable password reset for all users

add_filter( 'allow_password_reset', '__return_false' );Code language: PHP (php)

With this in place, a reset request from the lost password form fails with “Password reset is not allowed for this user”, and WordPress refuses to create reset keys at all. The same filter also covers wp-admin: since WordPress 6.3, the “Send password reset” action on the Users screen and the “Send Reset Link” button on a user’s profile disappear when reset is not allowed for that user.

Administrators can still change anyone’s password. Open Users → Edit, click Set New Password and save. That button is not affected by the filter.

Disable password reset for administrators only

A more common reason to turn reset off is security: if someone gets into an administrator’s mailbox, a reset email gives them the whole site. Blocking reset for administrators and leaving it on for everyone else (customers, members, authors) closes that door without creating extra support work:

add_filter( 'allow_password_reset', function ( $allow, $user_id ) {
	return user_can( $user_id, 'manage_options' ) ? false : $allow;
}, 10, 2 );Code language: PHP (php)

The filter receives the ID of the user asking for the reset, so you can check any role or capability. Returning $allow for everyone else keeps whatever another plugin decided. An administrator who forgets their password can then be reset by another administrator, or from the command line with WP-CLI: wp user update admin --user_pass="new-password".

Hide the “Lost your password?” link

Once reset is off, the link only leads to an error, so remove it as well. Since WordPress 6.1 the link has its own filter:

add_filter( 'lost_password_html_link', '__return_empty_string' );Code language: PHP (php)

Use this together with the reset filter above. On its own it only hides the link, and the reset form keeps working for anyone who knows the URL.

Send the reset pages back to the login form

With reset disabled, wp-login.php?action=lostpassword still shows the form and only fails when someone submits it. To skip the form completely, redirect the lost password and reset password screens to the normal login page:

function tp_disable_lost_password_screens() {
	wp_safe_redirect( wp_login_url() );
	exit;
}
add_action( 'login_form_lostpassword', 'tp_disable_lost_password_screens' );
add_action( 'login_form_retrievepassword', 'tp_disable_lost_password_screens' );
add_action( 'login_form_rp', 'tp_disable_lost_password_screens' );
add_action( 'login_form_resetpass', 'tp_disable_lost_password_screens' );Code language: PHP (php)

rp and resetpass are the screens a reset email links to, so links sent before you added the snippet stop working too. Only use the redirect when reset is off for everyone. If you block it for administrators only, other users still need these screens.

Why not the old gettext snippet

Older tutorials, including the 2014 version of this one, hid the link by replacing the text “Lost your password?” through the gettext filter. That has three problems. It runs on every translated string WordPress outputs, on every page. The trim( $text, '?' ) in it strips question marks from the start and end of all of those strings, not just the link. And it only empties the text: on WordPress 7.1 the link is still in the page as an empty <a> tag, and on a site in another language it doesn’t match at all. The lost_password_html_link filter avoids all of that.

Where to add this code

Add the snippet with a code snippets plugin instead of your theme’s functions.php, so it survives theme updates and you can switch it off without FTP. This guide shows how with the free Code Snippets plugin. On my own sites I use WPCodeBox, which keeps snippets in a cloud library so the same snippet can go on several sites. (Marius)

Disclosure: the WPCodeBox link is an affiliate link. If you buy through it, I earn a commission at no extra cost to you.