Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsYou can customize WordPress password recovery in two distinct ways: style or extend the built-in wp-login.php screens, or build a separate front-end recovery flow. Styling and small changes usually require less code. A separate flow must still validate WordPress’s reset key and account login, handle invalid or expired links, and update the password through WordPress.
Choose what you want to change
WordPress’s standard login and password-reset interface is served through wp-login.php. When someone requests a reset, WordPress sends a link to the email address associated with the account. “Customize the reset page” could mean changing its appearance, adding content, changing a link or redirect, editing the email, or replacing the recovery screens altogether. Those changes use different hooks and do not automatically provide one another’s behavior.
- Brand the existing screen or add a small message: use the built-in login page and its hooks.
- Change the URL used by lost-password links: filter the URL returned by
wp_lostpassword_url(). - Change the destination after a reset request is submitted: use
lostpassword_redirect. - Edit the reset email: filter
retrieve_password_message. - Offer a separate front-end experience: implement request and reset screens while preserving WordPress’s validation and password-update steps.
A changed URL or redirect alone is not a complete recovery flow. Decide first whether you need a visual adjustment or a separate way for users to request and complete a reset.
Customize the built-in wp-login.php screens
For visual changes and modest additions, extending the built-in login page keeps the standard recovery process in place. WordPress provides login actions and filters for modifying page content or behavior. The dynamic login_form_{$action} hook is available for login actions including lostpassword, resetpass, and rp.
Use the hook that corresponds to the screen or action you are changing, and keep the built-in form’s recovery controls usable. A change to the lost-password screen does not, by itself, alter the reset email or the page users see after submitting the form.
WordPress’s login customization guidance describes ways to customize or replace the login page: WordPress Developer Resources. The action-hook reference documents the login-form hooks: login_form_{$action}.
Change the lost-password link destination
wp_lostpassword_url() returns a lost-password URL and applies the lostpassword_url filter. Use that filter when you want links generated by that function to point somewhere other than the default lost-password screen.
Rank #2
Changing the destination only changes where the link points. The destination must provide the recovery experience you intend: for example, a custom request form that can initiate password recovery. A redirect to a branded page that has no working request or reset process can leave users unable to recover their accounts.
See the function and filter reference: wp_lostpassword_url().
Change where users land after they submit the request form
The lostpassword_redirect filter controls the destination after a visitor submits the lost-password form. It is separate from lostpassword_url: the latter changes a link’s destination, while this filter changes the post-submission destination.
Rank #3
Choose a destination that clearly explains what the user should expect next, such as checking the email address associated with the account. This redirect does not send the reset email itself or change the reset link in that email.
WordPress documents the filter at lostpassword_redirect.
Customize the password-reset email
The retrieve_password_message filter lets you change the body of the reset email. Keep the message understandable and preserve a valid reset URL so the recipient can continue the recovery process. WordPress documents that returning an empty filtered message prevents the email from being sent, so a callback that accidentally produces an empty string can break recovery.
See the retrieve_password_message reference for the filter details.
Build a separate front-end reset flow
A custom front-end flow can give a site a more consistent branded experience, but it has more responsibilities than redirecting users or displaying a form. It must request a reset, accept the reset link’s key and login, report invalid or expired links clearly, and let WordPress perform the password update.
- Request a reset: provide a form that starts WordPress’s password-recovery process for the supplied account information.
- Validate the reset link: pass the reset key and login to WordPress’s validation rather than treating the link as proof of validity on its own.
- Handle failure states: provide a useful path when a key is invalid or expired, such as returning to the request form.
- Update the password: use WordPress’s reset functionality to complete the change.
WordPress core documents get_password_reset_key() for creating a reset key, check_password_reset_key() for validating a key and login, and reset_password() for changing the password. In current core, reset keys are stored as hashes with a timestamp. Key validity is checked against the login, and the expiration period defaults to DAY_IN_SECONDS; it can be changed with password_reset_expiration. Do not assume a reset link is valid just because it contains key-like text: the core validation step is part of the flow.
Recommended Free Tools
References: get_password_reset_key(), check_password_reset_key(), reset_password(), and password_reset_expiration.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choose between the built-in page, custom code, and a plugin
| Option | Scope and effort | Email and redirect control | Core validation and upkeep |
|---|---|---|---|
| Customize built-in login screens | Styling or modest content and behavior changes; comparatively limited scope. | Use separate email and redirect hooks when those parts also need changing. | Retains the built-in recovery interface; maintain any customizations as WordPress changes. |
| Build a custom front end | Replaces or supplements the request and reset screens; requires implementing the full user journey. | Can present a custom experience, but email and redirect behavior still need their own implementation. | Must preserve core key-and-login validation and password updating; the site owner or developer is responsible for ongoing maintenance. |
| Use a front-end reset plugin | A possible route if you do not want to build the interface yourself; suitability depends on the plugin. | A WordPress.org directory listing describes front-end reset plugins that customize emails and redirects. | Confirm a specific plugin’s current maintenance, compatibility, and fit before relying on it; the listing alone does not establish those points. |
The WordPress.org directory includes a password-reset plugin search. Treat a directory listing as a starting point for evaluating a specific plugin, not as evidence that it is maintained, compatible with your site, or the right choice.
Quick Recap
Keep account recovery usable
- Test the full journey from the lost-password link through receiving the email and setting a new password.
- Check that a valid reset URL reaches the intended screen and that invalid or expired keys produce a clear recovery path.
- Verify that custom email content still contains a working reset link and does not become empty.
- Confirm that each redirect changes only the intended destination: the link destination and the post-submission destination are separate settings.
- Review custom code and plugin compatibility when updating WordPress or other site components.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
