If users are receiving password reset emails they didn’t request, your WordPress site may be vulnerable to automated abuse. This is a common issue caused by bots targeting login and password reset forms.
In this guide, we’ll walk through how to prevent unauthorized password reset attempts by adding Google reCAPTCHA to custom WordPress login and “forgot password” pages—even when standard plugins don’t work.
Issue Background
A WordPress site experienced the following issue:
- A user received a password reset email they did not request
- Bots were submitting the forgot password form and triggering reset emails
Additional complication:
- The site used a custom forgot password page built with Elementor Canvas
- Standard reCAPTCHA plugins were not loading on this page
This left the form unprotected and vulnerable to abuse.
Diagnosis
1. No bot protection
- No CAPTCHA or validation existed on login/reset forms
2. Plugin limitation on custom pages
- Advanced Google reCAPTCHA did not load on Elementor Canvas templates
3. Custom implementation required
- Standard plugin hooks were bypassed by the page template
Resolution Steps
Step 1: Install and configure Advanced Google reCAPTCHA
- Add site key and secret key
Step 2: Identify the custom page ID
- Target the specific forgot password page
Step 3: Enqueue reCAPTCHA script manually
add_action('wp_enqueue_scripts', function() {
if (is_page(597)) {
wp_enqueue_script('google-recaptcha', 'https://www.google.com/recaptcha/api.js?render=your_site_key', [], null, true);
}
});Step 4: Inject token into form
grecaptcha.ready(function() {
grecaptcha.execute('your_site_key', {action: 'forgot_password'}).then(function(token) {
document.querySelector('#recaptcha_token').value = token;
});
});Step 5: Validate server-side
add_action('lostpassword_post', function() {
$token = $_POST['recaptcha_token'];
// Verify token with Google API
});Step 6: Package as a custom plugin
- Improves maintainability and scalability
Step 7: Test thoroughly
- Ensure legitimate users can reset passwords
- Confirm bots are blocked
Final Outcome
- Password reset abuse was prevented
- reCAPTCHA worked on custom Elementor pages
- No disruption to user experience
- Secure and scalable solution implemented
If you’re dealing with WordPress security issues or spam submissions, our team can help implement secure solutions.
