The short answer
Go to the login page by typing the address yourself, click Lost your password, and enter your username or account email. Open the email you asked for and set a new, long, unique password. If nothing arrives, check spam and the address on file, then ask us. Never send a password to anyone.
The safe reset flow
The golden rule is that you start the reset. You go to the real login page and ask for the email. You never begin a reset because an email told you to. That one habit defeats most phishing, because a fake reset email is only dangerous if you follow it.
- 1Type the login address into your browser yourself or use your bookmark. For WordPress this is usually your domain plus /wp-admin. See log in to your website if you are unsure.
- 2Click Lost your password, which is how WordPress labels the link on its login screen.
- 3Enter the username or the email address on the account, then submit.
- 4Open the email that arrives and follow its link. Check that the link goes to your own domain before you enter anything.
- 5Choose a new password using your password manager's generator, and let the manager save it.
- 6Log in once to confirm it works. If you use a second step, finish that too.
- 7Sign out of any other device you do not recognize, and tell whoever else uses the account that the password changed.
Why the reset email may not arrive
A missing reset email feels like a broken site, but the cause is usually one of the following. Check them in this order.
| Cause | How to check | What to do |
|---|---|---|
| It went to spam or a promotions tab | Search your mailbox for the site name or the word password | Mark it as not spam and use the link |
| Different email address on the account | Try your other addresses, including an old work email | Reset with the username instead of the email |
| Wrong username | Look for an earlier welcome email that names it | Try the email address on the account instead |
| The site cannot send email reliably | Other site emails, such as form notifications, also go missing | This is a site email problem. Read forms not sending emails |
| Your own mail server is slow or filtering | Wait a few minutes, then check any quarantine area your company mail has | Ask whoever manages your company email to release it |
| Too many attempts | Several resets requested in a row can be rate limited | Wait, then request once and leave it alone |
Requesting five resets in a row does not make the email faster. Each new request can invalidate the one before, so the link you click might be the old one.
What not to do
- Do not click a reset link you did not request. Close the email and go to the site directly.
- Do not send your old or new password to anyone, including us, in a ticket, an email or a chat message.
- Do not reuse a password from another site. If one site leaks, criminals try the same combination everywhere else.
- Do not save the new password in a note on your phone or a shared spreadsheet.
- Do not add a number to the end of the old password and call it new. It is easy to guess.
- Do not keep resetting if something looks wrong. A reset you did not ask for can mean someone else is trying to get in. Tell us.
What a good password looks like now
Older advice told people to mix capital letters, numbers and symbols and change the result every 90 days. Current official guidance has moved away from that because it produced passwords that were hard to remember and easy to guess.
The UK National Cyber Security Centre recommends combining three random words. Its page describes the result as long enough and strong enough for most purposes and easier to remember than a highly complex password. Its example is a run of unrelated words. The word that matters is random: words you choose yourself, such as your pet's name and your street, are far easier to guess than words picked at random.
NIST, the US standards body, sets out similar thinking in its digital identity guidelines. Sites should require at least 15 characters when a password is the only sign-in factor, and at least 8 when it is only used alongside another factor. They should not impose composition rules such as mandatory symbols, should not force periodic changes unless there is evidence of compromise, and should allow password managers and pasting.
The practical result: length matters most, uniqueness matters next, and a password manager is the way to get both without remembering anything. Keep a single strong passphrase for the manager itself and a second step on the manager account.
Password manager advice in plain terms
A password manager is an app that creates, stores and fills in passwords. You remember one strong passphrase and it handles the rest. Reputable options exist from several vendors and many browsers have one built in. The built-in ones are fine to start with. What matters is that you use one at all.
- Make the manager's own passphrase long and random, and write it down once on paper kept somewhere secure at home or in a safe.
- Turn on a second sign-in step for the manager account, preferably an authenticator app or security key.
- Let it generate passwords of 20 characters or more for every site. You never type them, so length is free.
- Use it to store the login address as well. A manager that refuses to autofill on a page is telling you the page is not the real one.
- Do not share one personal vault. For team passwords, use the manager's sharing feature or, better, give each person their own login.
Example: A reset that was actually a trap
Tom, an office manager, gets an email saying his website password has expired and will be disabled in 24 hours, with a Reset Now button. He has not asked for a reset and the sender's address is one letter off from his hosting company. He does not click. Instead he types the real login address, requests a reset himself and receives the genuine email within a minute. He then forwards the suspicious message to his project manager as a screenshot link. NIST's own guidance supports his instinct on the broader point: periodic forced expiry is not good practice, so a message demanding it should look odd to you.
When to ask us
Ask us if the reset email still has not arrived after you have checked spam, the address on file and your other mailboxes, if you are locked out of the email address that the account uses, or if you received a reset you did not ask for.
Send a request through the support form and tell us which site, which username if you know it, the email address you expected the reset to go to, and roughly when you tried. If you can, add a screenshot as a Google Drive or Loom link. Never include a password. Our team can reset or restore access without seeing one. If the unexpected reset suggests someone else is trying to get in, read suspected hack and switch on two-factor sign-in.
