# Forgot\_password abuse

**URL:** <https://meta.discourse.org/t/forgot-password-abuse/150668>\
**Category:** Feature\
**Created:** [May 7, 2020, 12:51am UTC](https://meta.discourse.org/t/forgot-password-abuse/150668 "2020-05-07T00:51:56Z")\
**Posts on this page:** 1\
**Showing post:** 13

<div class="post-metadata">

**Author:** ![riking](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/riking/32/170938_2.png) [@riking](https://meta.discourse.org/u/riking)\
**Post date:** [May 7, 2020, 6:58am UTC](https://meta.discourse.org/t/forgot-password-abuse/150668/13 "2020-05-07T06:58:29Z")

</div>

We can rate limit the requests _for_ a particular user in addition to requests _from_ a particular place (a limit which we can see working quite well right now). Maybe give people up to 2 non-expired reset tokens before we say “please just wait for the email”?

---

_[View the full topic](https://meta.discourse.org/t/forgot-password-abuse/150668)._