WordPress Password Reset Email Not Sending

Two separate jobs. First get back into the site, which does not require email at all. Then fix mail delivery, because if reset emails are failing, so are order confirmations, form notifications and every other message the site sends.

Get back in without email

Pick whichever access you have:

# SSH available.
wp user update admin --user_pass='a-long-unique-passphrase'

Without SSH, set the password directly in the database with phpMyAdmin, using the MD5 function on the user_pass column. Both routes, plus a temporary snippet method for file-only access, are detailed in how to reset a WordPress admin password.

If the account itself is damaged rather than just locked, create a new administrator instead — see adding an admin user via phpMyAdmin.

Then find out why the email failed

Check the cheap explanations first:

1. Spam folder, and any quarantine your provider runs.
2. The address on the account. Check user_email in the database; it may not be the address you assume.
3. The 24-hour expiry, and the fact that a new request invalidates the previous link.
4. Rate limiting. Repeated requests can trigger host-level throttling, making the situation worse.

Then test whether the site can send anything at all: add a user with an address you control, or submit the contact form. If nothing arrives from any source, it is a site-wide mail problem.

The usual root cause

WordPress passes mail to PHP's mail() function, which most hosts either disable or send from an unauthenticated address. Receiving providers discard it silently — no bounce, no error, and WordPress reports success because PHP accepted it.

The fix is authenticated SMTP with a From address on your own domain, backed by SPF and DKIM records. The full sequence, including how to log the actual failure reason, is in WordPress not sending emails.

Capture the error while you work:

<?php
// wp-content/mu-plugins/mail-debug.php
add_action('wp_mail_failed', function (WP_Error $error) {
    error_log('wp_mail failed: '.$error->get_error_message());
});

Request a reset, then read wp-content/debug.log — turn on debug logging if it does not exist yet.

Causes specific to reset emails

A plugin filtering the message. Membership, security and branding plugins hook the reset email to customise it, and a broken template can stop it being sent. Test with those plugins disabled.

Disabled password reset. Some security plugins offer an option to disable reset entirely for administrators. Check before assuming a delivery fault.

A rewritten link. Corporate mail scanners rewrite URLs, which can break the reset key. Copy the link text into the address bar manually rather than clicking.

A cached login page. The reset form on a fully cached page can submit a stale nonce. Exclude wp-login.php from page caching — see how to clear the WordPress cache.

A wrong site URL. The link is built from siteurl. If that points at the wrong domain, the email arrives with a link that goes nowhere useful — check Settings → General or the constants in wp-config.php.

Verify the repair properly

1. Send a test to an address at a different provider from your own.
2. Confirm it lands in the inbox rather than spam.
3. Check the headers show spf=pass and dkim=pass.
4. Complete a real reset from start to finish, including clicking the link.
5. Test the other notifications too — new user, comment moderation, and on a store, an order email.

Make it less painful next time

• Keep the administrator email address current and monitored.
• Use a password manager, so resets are rare.
• Enable two-factor authentication and store the recovery codes outside the site.
• Keep the mail-failure logger in place permanently; it costs nothing and turns the next incident into a two-minute check.
• Keep a second administrator account, held by someone else, for exactly this situation.