Getting WordPress password reset emails you didn't ask for?

A guide for site owners and their users. Updated October 17, 2026.

The email says "Someone has requested a password reset for the following account", and that someone wasn't you. Maybe it's one email, maybe it's a dozen a day. Here's what it means, whether anyone can get in, and how to make it stop.

First: is someone in my account?

No. A reset request only sends a link to the email address on the account, which is yours. Nothing changes unless someone opens that link, and only you can. WordPress says so in the email itself: "If this was a mistake, ignore this email and nothing will happen." The link stops working after a day.

So: don't click it, and you're fine. Two things are worth a look, though:

• Is it really from your site? A real one comes from your site's own address and its link starts with your site's address, followed by /wp-login.php?login=…&action=rp. Fake "reset your password" emails are a common way to steal passwords. If the link goes anywhere else, it's phishing.
• Did a "Password Changed" email follow? That one means a password really was changed. If you didn't change it, reset it yourself straight away from your site's login page, and tell the site owner.

Why it happens

Anyone can type a username or email address into WordPress's "Lost your password?" form (/wp-login.php?action=lostpassword), or into WooCommerce's at /my-account/lost-password/. Bots do it for a few reasons:

• To find out which accounts exist. Both forms say so when an account doesn't: WordPress replies "There is no account with that username or email address", and WooCommerce "Invalid username or email." A bot that gets an email sent instead knows the account is real, and moves on to guessing its password.
• As part of a login attack. Bots that are guessing an account's password often try the reset form too.
• To flood someone's inbox, or to send mail through your site at all. Every request is an email your site sends, and enough of them can hurt how well your other emails get delivered.

How do they know your username? Usually because WordPress shows it: in the public user list at /wp-json/wp/v2/users, and in author pages like /?author=1. Our guide to hiding WordPress usernames covers all five places.

The email itself shows the address the request came from, when the person asking wasn't logged in: "This password reset request originated from the IP address …". If the same address keeps showing up, that's one bot.

How a site owner stops it

1. Limit reset requests

A real person asks for a reset once, maybe twice. Limit how many requests one internet address can make in an hour, and how many reset emails one account can get in an hour. WordPress has no setting for this; it needs a plugin or a firewall rule. Make sure the limit covers WooCommerce's lost-password form too, not just WordPress's.

2. Stop showing usernames

Bots can only ask for resets for accounts they know about. Hiding usernames from the user list and author pages takes away the easy list. It doesn't stop a bot that guesses email addresses, so do it together with the limit.

3. Add a "prove you're human" check to the form

A check like Cloudflare Turnstile on the lost-password form stops simple bots. It's best shown only when something looks wrong, so real people aren't slowed down for no reason.

4. If one account is the target

WordPress doesn't let you change a username (the profile page says "Usernames cannot be changed."). If one account keeps getting reset emails, you can make a new account for that person with a less obvious username, move their posts to it when you delete the old one, and have them log in with their email address from then on. Give every admin account a strong, unique password and two-factor login either way.

The free Ropeline plugin does steps 1 to 3

The free Ropeline plugin limits password reset requests to 5 an hour from one address, and 3 reset emails an hour to one account, on WordPress's lost-password form and WooCommerce's. When a real person on a busy network hits the limit, they can pass a quick Cloudflare Turnstile check and carry on, once you've added your free Turnstile keys. For its first 7 days Ropeline only records what it would have stopped, so you can see it won't get in anyone's way; then it starts blocking.

It also locks out password guessers on the login page, WooCommerce's login, XML-RPC and application passwords. Hiding usernames is part of Ropeline Pro.

Questions

I'm not the site owner. What should I do?

Ignore the emails and don't click the links. If they keep coming, tell the site's owner: they can limit them. Use a strong password that you don't use anywhere else, so a bot that guesses at your account gets nowhere.

Should I change my password?

Only if you got a "Password Changed" email you didn't expect, or you reuse that password on other sites. The reset email on its own doesn't mean anyone knows your password.

Can I turn off password resets altogether?

You can, with a plugin or a few lines of code, but then anyone who forgets a password needs you to reset it for them. Limiting resets keeps the way back in for real people.