I'm trying to harden a Joomla website (v3.9.13).

One problem which has been picked up is that the "Forgot password" can be used by a malicious person to check whether an email address is valid or not.

If you put in a bad one, it tells you that it's invalid.

If you put in a good one, it tells you that an email has been sent.

This means you can tell whether the email is valid or not.

Also asked on https://forum.joomla.org/viewtopic.php?f=714&t=976191#p3587991

  • 1
    This is not a bad question, but I do agree with others that it was already asked. If for any reason this doesn't give you what you need, you may edit your question to separate it from the focus on the other page and your question may qualify for reopening. (But with any luck that other page will be just what you need.) Dec 2, 2019 at 20:21
  • Thanks. I had searched for a previous answer, but my search terms hadn't found this one above.
    – Rachel
    Dec 3, 2019 at 9:35


Browse other questions tagged or ask your own question.