# Received password reset email though I didn’t request one?
**URL:** https://meta.discourse.org/t/received-password-reset-email-though-i-didn-t-request-one/283735
**Category:** Support
**Created:** [October 28, 2023, 1:09am UTC](https://meta.discourse.org/t/received-password-reset-email-though-i-didn-t-request-one/283735 "2023-10-28T01:09:49Z")
**Posts on this page:** 16
**Page:** 1
### Author:  [@Plabforum](https://meta.discourse.org/u/Plabforum)
#### Post date: [October 28, 2023, 1:09am UTC](https://meta.discourse.org/t/received-password-reset-email-though-i-didn-t-request-one/283735/1 "2023-10-28T01:09:49Z")
I randomly received a mail from discourse stating that somebody asked to reset my password. I was watching movie when that mail came, it was scary. I right away changed my password and authentication key.
Can somebody please look into this? I am scared.
---
### Author:  [@simon](https://meta.discourse.org/u/simon)
#### Post date: [October 28, 2023, 1:31am UTC](https://meta.discourse.org/t/received-password-reset-email-though-i-didn-t-request-one/283735/8 "2023-10-28T01:31:36Z")
> [@Plabforum](#):
>
> I randomly received a mail from discourse stating that somebody asked to reset my password.
There is probably nothing to worry about. Discourse will send that message to a user’s email address if someone clicks the “I forgot my password” link on the ~~signup~~ login form and enters the user’s email address into the form:
There is nothing preventing anyone from entering any email address into the form. This is standard practice for handling forgotten passwords on the web. The security feature that is built into this is that the password reset email is only sent to the email address that is entered into the form, so unless the person who triggered the email also has access to the email’s inbox, they will not be able to gain access to the site.
You might consider enabling second factor authentication on your Discourse account though. That will give you an added layer of security on the off chance that someone had access to your email account. You can enable two factor authentication from your Discourse account’s Security page. If you have any trouble setting it up, you can get some help with that on here.
It is unlikely you need to contact HackerOne about the issue. HackerOne is intended for people who have discovered a repeatable exploit in Discourse. I think what you are dealing with is the expected functionality of the “I forgot my password” form.
Edit: are you an admin on the site? If so, it’s possible that your email address is set in the `site contact username` setting. That email address is displayed on the site’s About page. It would be easy for someone to pull it from there. Ideally, all site staff will enable two factor authentication on their Discourse accounts.
---
### Author:  [@Plabforum](https://meta.discourse.org/u/Plabforum)
#### Post date: [October 28, 2023, 1:46am UTC](https://meta.discourse.org/t/received-password-reset-email-though-i-didn-t-request-one/283735/9 "2023-10-28T01:46:23Z")
Thank you for the prompt reply and I think you are right!
I dont have any sign up, only login page. Just above the login page there is a short message showing my email address to contact me and I think someone must have just used that email address to create forgot password link. That’s clever! I have changed the Email address and it’s not connected to any account now.
Thank you so much! When this happened, in a split section, I saw so many variations, trying to work on all possible outcomes.
Two factor authentication is on from the start.
Well it was a false alarm, which I am glad to say and bottom of my heart, I would like to appreciate the amazing platform Discourse have made. I am very happy to use it!! ❤ ❤ ❤
---
### Author:  [@simon](https://meta.discourse.org/u/simon)
#### Post date: [October 28, 2023, 1:53am UTC](https://meta.discourse.org/t/received-password-reset-email-though-i-didn-t-request-one/283735/10 "2023-10-28T01:53:11Z")
Those kinds of emails always freak me out a bit, so I get it.
> [@Plabforum](#):
>
> I dont have any sign up, only login page.
There was actually a typo in my reply. The “forgot password” link is on the login modal, not the signup modal, so it’s likely that all they did is click that link and access the form.
> [@Plabforum](#):
>
> Two factor authentication is on from the start.
That’s great!
---
### Author:  [@anon65426961](https://meta.discourse.org/u/anon65426961)
#### Post date: [October 28, 2023, 2:01am UTC](https://meta.discourse.org/t/received-password-reset-email-though-i-didn-t-request-one/283735/11 "2023-10-28T02:01:12Z")
Technically I don’t believe someone needs to know the e-mail for an account to request password reset, just the username.
If the username is public, anyone could type that in forgot password form and an e-mail like this would be sent.
No security risk as long as e-mail inboxes are secure.
---
### Author:  [@Plabforum](https://meta.discourse.org/u/Plabforum)
#### Post date: [October 28, 2023, 1:10pm UTC](https://meta.discourse.org/t/received-password-reset-email-though-i-didn-t-request-one/283735/12 "2023-10-28T13:10:21Z")
I understand for someone this could be life saving but at the same time could give heart attack as well.
If there a way to disable it for username?
---
### Author:  [@Plabforum](https://meta.discourse.org/u/Plabforum)
#### Post date: [October 28, 2023, 1:12pm UTC](https://meta.discourse.org/t/received-password-reset-email-though-i-didn-t-request-one/283735/13 "2023-10-28T13:12:35Z")
> [@anon65426961](#):
>
> e-mail inboxes are secure
Also are there any steps you would recommend for that?
---
### Author:  [@Jagster](https://meta.discourse.org/u/Jagster)
#### Post date: [October 28, 2023, 1:28pm UTC](https://meta.discourse.org/t/received-password-reset-email-though-i-didn-t-request-one/283735/14 "2023-10-28T13:28:26Z")
Don’t use free and shady email services, excluding Gmail and Hotmail, but including `mail.ru`, `alibaba` etc. And use strong passwords plus VPN when used free or otherwise unreliable wifi. Normal security measurements.
But this has nothing to do with Discourse, though.
---
### Author:  [@Plabforum](https://meta.discourse.org/u/Plabforum)
#### Post date: [October 28, 2023, 1:52pm UTC](https://meta.discourse.org/t/received-password-reset-email-though-i-didn-t-request-one/283735/15 "2023-10-28T13:52:47Z")
I am an apple user and I am subscribed to iCloud plus, which offers private relay (basically VPN).
Yes I am using extremely strong and long password suggested and kept in keychains of iCloud.
Would that be enough?
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [October 28, 2023, 2:36pm UTC](https://meta.discourse.org/t/received-password-reset-email-though-i-didn-t-request-one/283735/16 "2023-10-28T14:36:29Z")
> [@Plabforum](#):
>
> If there a way to disable it for username?
You can use the `hide email address taken` admin setting, which would then require the full email for password reset requests:
Advice on creating a password for your email account would be out of scope for this forum, though I’m sure you’ll find some good resources offered by your email provider for that. 👍
---
### Author:  [@anon65426961](https://meta.discourse.org/u/anon65426961)
#### Post date: [October 28, 2023, 4:11pm UTC](https://meta.discourse.org/t/received-password-reset-email-though-i-didn-t-request-one/283735/17 "2023-10-28T16:11:31Z")
As Jakke mentioned it depends on your mail service, iCloud is probably fairly secure but I am no expert about that.
Often there is an option for two factor authentication, which means you need both a password and a physical security key to login, or authentication code generated by an authentication app.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [October 28, 2023, 6:46pm UTC](https://meta.discourse.org/t/received-password-reset-email-though-i-didn-t-request-one/283735/18 "2023-10-28T18:46:13Z")
> [@Plabforum](#):
>
> at the same time could give heart attack as well.
I believe the message says that if your didn’t request the message there is nothing to worry about. Right?
---
### Author:  [@anon65426961](https://meta.discourse.org/u/anon65426961)
#### Post date: [October 28, 2023, 7:38pm UTC](https://meta.discourse.org/t/received-password-reset-email-though-i-didn-t-request-one/283735/19 "2023-10-28T19:38:11Z")
For password reset here at Meta, e-mail reads:
_“Somebody asked to reset your password. If it was not you, you can safely ignore this email.”_
Probably this can be customized to say something different for different sites.
With the password reset option it also says to contact discourse staff if someone has lost e-mail access, don’t know what their process is for that.
---
### Author:  [@Jagster](https://meta.discourse.org/u/Jagster)
#### Post date: [October 28, 2023, 8:36pm UTC](https://meta.discourse.org/t/received-password-reset-email-though-i-didn-t-request-one/283735/20 "2023-10-28T20:36:20Z")
Admin can change (almost) every texts here. Just go to `admin > customize > text`.
Even that text is quite general one it works for (almost) every forums — just because things are so, requesting new password is not anykind security risk. It can be a bit annoying, if it happends quite often (as happened on Instagram a while ago).
---
### Author:  [@Plabforum](https://meta.discourse.org/u/Plabforum)
#### Post date: [October 29, 2023, 12:58pm UTC](https://meta.discourse.org/t/received-password-reset-email-though-i-didn-t-request-one/283735/21 "2023-10-29T12:58:25Z")
This was helpful, Thank you!! ❤
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [November 28, 2023, 12:59pm UTC](https://meta.discourse.org/t/received-password-reset-email-though-i-didn-t-request-one/283735/22 "2023-11-28T12:59:01Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.