{"id":786,"date":"2026-10-20T09:04:40","date_gmt":"2026-10-20T08:04:40","guid":{"rendered":"https:\/\/userswp.io\/documentation\/article\/password-reset-not-working\/"},"modified":"2026-10-20T09:04:40","modified_gmt":"2026-10-20T08:04:40","slug":"password-reset-not-working","status":"publish","type":"gd_place","link":"https:\/\/userswp.io\/documentation\/article\/troubleshooting\/password-reset-not-working\/","title":{"rendered":"UsersWP password reset: no link in the email or &#8220;Invalid key&#8221;"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">A UsersWP password reset has three parts: the user asks for a reset on the forgot password page, WordPress creates a reset key, and the email links to your reset page with that key. Most problems come from one of those steps being blocked or the key no longer matching.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">No email or no reset link in the email<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Check that Forgot password email is enabled on UsersWP &gt; Emails &gt; User Emails.<\/li>\n\n\n\n<li>Click Show Advanced and look at the Body of that email. The reset link is inserted by the <code>&#091;#login_details#&#093;<\/code> tag. If the tag was removed, the email arrives without a link.<\/li>\n\n\n\n<li>Check UsersWP &gt; General &gt; Pages and make sure Forgot Password Page and Reset Password Page are set to pages that contain the UsersWP forgot and reset forms.<\/li>\n\n\n\n<li>If no email is sent at all, a plugin may be blocking resets through the WordPress <code>allow_password_reset<\/code> filter. Some security and membership plugins do this for certain roles. Turn them off to test.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If other site emails also go missing, the problem is mail delivery. Install an SMTP plugin and an email log plugin so you can see what was sent.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">&#8220;Invalid key&#8221; when setting the new password<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Each reset request creates a new key and cancels the previous one. If a user clicks &#8220;forgot password&#8221; twice, only the link in the newest email works.<\/li>\n\n\n\n<li>Reset links expire after one day by default.<\/li>\n\n\n\n<li>A link can only be used once. After the password is changed, the same link shows &#8220;Invalid key&#8221;.<\/li>\n\n\n\n<li>A page cache must not serve the reset page. Exclude the reset page from your caching plugin and any server or CDN cache.<\/li>\n\n\n\n<li>Some email services rewrite links for click tracking. If the rewritten link loses the <code>key<\/code> or <code>login<\/code> part of the URL, the key fails. Copy the link from the email and compare it with what reaches the browser.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Ask the user to request one new reset email, wait for it, and use only that link. That solves most &#8220;Invalid key&#8221; reports.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A UsersWP password reset has three parts: the user asks for a reset on the forgot password page, WordPress creates a reset key, and the email links to your reset page with that key. Most problems come from one of those steps being blocked or the key no longer matching. No email or no reset [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","template":"","meta":{"footnotes":""},"article\/tags":[],"article\/categories":[39,7],"class_list":["post-786","gd_place","type-gd_place","status-publish","hentry","gd_placecategory-troubleshooting","gd_placecategory-tips-tricks-more"],"_links":{"self":[{"href":"https:\/\/userswp.io\/documentation\/wp-json\/wp\/v2\/article\/786","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/userswp.io\/documentation\/wp-json\/wp\/v2\/article"}],"about":[{"href":"https:\/\/userswp.io\/documentation\/wp-json\/wp\/v2\/types\/gd_place"}],"author":[{"embeddable":true,"href":"https:\/\/userswp.io\/documentation\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/userswp.io\/documentation\/wp-json\/wp\/v2\/comments?post=786"}],"version-history":[{"count":0,"href":"https:\/\/userswp.io\/documentation\/wp-json\/wp\/v2\/article\/786\/revisions"}],"wp:attachment":[{"href":"https:\/\/userswp.io\/documentation\/wp-json\/wp\/v2\/media?parent=786"}],"wp:term":[{"taxonomy":"gd_place_tags","embeddable":true,"href":"https:\/\/userswp.io\/documentation\/wp-json\/wp\/v2\/article\/tags?post=786"},{"taxonomy":"gd_placecategory","embeddable":true,"href":"https:\/\/userswp.io\/documentation\/wp-json\/wp\/v2\/article\/categories?post=786"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}