Logo

Remove Password Reset

This guide explains how to remove the "Forgot Password" functionality. After removal, users will need to contact an administrator to reset their password.

Consider Carefully
Password reset is a common user expectation. Removing it will increase administrator workload for password resets. Only remove if you have a specific security or workflow reason.

Step 1: Remove Forgot Password Link

In Pages/Account/Login.cshtml, delete the forgot password link:

<!-- DELETE this line: -->
<p>
    <a asp-page="./ForgotPassword">Forgot your password?</a>
</p>

Step 2: Delete Password Reset Pages

Delete these files from Pages/Account/:

Step 3: Delete Help File

Delete wwwroot/help/user/password-reset.htm

Step 4: Update Help Index

In wwwroot/help/default.htm, remove the password reset link from the user help section.

Step 5: Ensure Admin Can Reset Passwords

Verify that the admin Edit User page (Pages/Admin/Users/Edit.cshtml) includes the ability to set a new password for users. This becomes the only way to reset forgotten passwords.

Alternative: Keep for Admins Only

Instead of removing password reset entirely, you could modify it to only work for admin-initiated resets:

  1. Keep the reset pages but remove public links
  2. Add an "Email Reset Link" button to the admin Edit User page
  3. Admin triggers reset, email is sent to user

Verification

After removal, verify: