Multiple users are reporting their 'forgot password' / password reset function is being triggered, and that they're receiving emails with the verification code etc, even though they didn't request a password reset.

The forgot password / password reset form requires an email address input so I can't imagine how spam bots would be able to submit that form (without knowing users email address). So I am baffled.

How to prevent this from happening?

1 Answer 1


You can prevent this attack by implementing some low-grade authentication before firing the reset script.

You might use a recaptcha or automated math question, to stop automated (bot) attacks.

To more strenuously confront both bot and human attacks in a personalized fashion, have your users verify their account by answering a "secret question" (which was part of the registration process) before triggering the reset process.

Here's some additional reading:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.