Remove lost password form and URL

Question

I've shut down password resets for all users.

I now need to prevent /wp-login.php?action=lostpassword from doing anything should anyone manually input the URL into their browser.

i.e. I don't want the password reset form to show.

Can I disable the action that's being passed by the URL or can I redirect /wp-login.php?action=lostpassword to /wp-login.php?

Answer 1

Hi Please try to use this in your functions.php it will redirect user to login form when user try to access lost password page:

add_action('init','possibly_redirect'); 
function possibly_redirect(){ 
   if (isset( $_GET['action'] )){  
     if ( in_array( $_GET['action'], array('lostpassword', 'retrievepassword') ) ) {
        wp_redirect( '/wp-login.php' ); exit;
     }
  }
}

Or Please follow below approach used from this answer answered here with some details based on comments of @Clarus Dignus

function disable_lost_password() {
    if (isset( $_GET['action'] )){
        if ( in_array( $_GET['action'], array('lostpassword', 'retrievepassword') ) ) {
            wp_redirect( wp_login_url(), 301 );
            exit;
        }
    }
}
add_action( "login_init", "disable_lost_password" );

Answer 2

You can use .htaccess and mod_rewrite.

Forbidden response:

RewriteCond %{QUERY_STRING} ^action=lostpassword$ [NC]
RewriteRule ^wp-login.php$ - [F,NC]

Redirect to wp-login.php:

RewriteCond %{QUERY_STRING} ^action=lostpassword$ [NC]
RewriteRule ^wp-login.php$ wp-login.php [R=301,NC,QSD,L]

(for QSD flag you need Apache 2.4.0+)

Answer 3

I know this is an older thread, but I have a couple of improvements. First, since they can use GET or POST, I would be checking for $_REQUEST instead of $_GET

Second, redirect them somewhere useless, instead of back to your site. Like 'http://127.0.0.1' If they don't have a web server there, the bot will at least stall for a few seconds waiting for a reply. Anything we can do to hinder these a-holes.