Reset password provided completely by FC Auth
Will we some day have opportunity to reset password completely inside of Fluent Auth reset form? I want to disable ALL default wordpress /wp-login.php URLs/features but there is no chance to make password reset in Fluent reset form now. You can request password reset but resetting is possible only in default wordpress form.
Can Shahjahan Jewel answer it? I am sure that more people will want to know that.
Actually, there is a way. Install FluentSnippets (free) and check out this code. I run it on my site and it prevents people from going to the old WP forms.
William Beem I will try this, but honestly it shouldn't be needed.
William Beem but when you go to email for reset link it lead you in default wordpress "new password" form because there is not such a feature from FC.
William Beem My idea is making reset possible in this form and dont use wordpress default to create new password.
William Beem Ok tested it, however this does only halve the job. Positive is that this does redirect to the community login page. The actual password reset however still is Wordpress, which is the issue here.
Drive Zone You are not alone. ;)
J V Thank you for confirming! :)
Drive Zone Yes, you're right. That's the one part of this process that still relies on the WordPress form. I agree it would be nice to change it to something customizable.
On my site, I see a reset page like this one that I designed. It sends an email with a link. That link goes to another form page, not the WordPress default.
William Beem How did you achieve this? I'm currenlty using Divi Theme. I dont know how to code. I realise that for me, it might not be possible. My users, like others, are going to the default WordPress 'Reset Password' page.
Russell Horton To be honest, I'll have to go back and look to see how I did it.
This is the page you reach after clicking the link in the password reset email. It's all customizable.
William Beem and where do you inset new password when you click link from email? You can request reset password here only. Not change it. Try it yourself.
In my Cloudflare WAF rules, I don't block all wp-login or wp-admin for every user. Instead, I use a rule to have a Managed Challenge for specified ASNUM visitors. Here's one of my rules to give an example:
(
(
ip.src.asnum in {
60068 9009 16247 51332 212238 131199 22298 29761
62639 206150 210277 46562 8100 3214 206092
206074 206164 213074
}
)
or
(
http.request.uri.path contains "wp-login"
and http.request.method eq "POST"
)
or
(
http.request.uri.path contains "/wp-admin/"
)
or
(
http.request.uri.path contains "xmlrpc.php"
)
)
There are some visitors I don't want and also bots that I don't want. I have a series of WAF rules that filters them out before they ever get to the server to login.