Password reset emails not arriving? A checklist
Locked out and the reset email never comes? Work through this checklist, from the quick checks to the deeper ones, to find where it went.
You click Lost your password, type your address, and wait. Five minutes later there is still nothing. If this is your own site, you are locked out. If it is a customer or a member, you are about to get an unhappy message.
A password reset is an ordinary email, so the same things that stop other WordPress email stop it too. The good news is that it is also the best test email you have. Work down this list in order. Most problems show up in the first few steps.
First, the quick checks
1. Wait two minutes and check spam
Email is not always instant. Give it a couple of minutes, then look in spam or junk, and in tabs like Promotions or Updates. The subject usually contains "Password Reset". Search the whole mailbox for it rather than just scanning the inbox.
2. Check the address on the account
This catches more people than you would think. The reset goes to the address stored on the user account, not whatever you typed in a note somewhere. An old address, a typo, or a mailbox you no longer use is common. If you can log in as another administrator, open Users and look at the email on the account.
3. Try a different address
Request a reset for an account that uses a different provider, such as Gmail on one and Outlook on another. If one works and the other does not, the problem is how that provider treats your mail, not whether WordPress can send.
4. Try the username instead of the email
WordPress accepts either on the reset form. If one fails with an error message and the other does not, you may have two accounts or a duplicate address.
Then, check the sending side
5. Look at the From address
If you can get any email from your site, open its details. Is it from wordpress@yourdomain.com? That address usually does not exist, and your host may not be allowed to send as that domain. Mail from an address on your own domain, set up properly, is trusted far more. See why WordPress emails go to spam.
6. Check your domain's records
Look for SPF, DKIM and DMARC records on your domain. Missing records are the number one reason reset emails end up in spam. Our plain-English guide to SPF, DKIM and DMARC shows what to look for.
7. Check your host
Some hosts disable PHP's mail() function, or limit how many emails you can send an hour. Your host's help pages or support team can tell you. If mail is turned off, WordPress will try to send and quietly fail.
8. Look for plugin conflicts
Only one thing should be in charge of sending email. Check for:
- Two SMTP or mail plugins active at once.
- A security plugin that blocks outgoing requests or changes login behavior.
- A login or membership plugin that replaces the standard reset email, with its own settings.
- A caching plugin serving a cached login page, so the reset form never submits properly.
To test, deactivate the suspects one at a time, request a reset after each, and note when it starts working. If you cannot get into the dashboard, you can rename a plugin's folder over FTP or your host's file manager to switch it off.
9. Check the filters and rules
Look in the receiving mailbox for filters, forwarding rules or an inbox rule that moves messages somewhere unexpected. For company mailboxes, an administrator may have a gateway that quarantines unknown senders. Ask whoever runs it to check the quarantine.
Finally, find out whether WordPress sent it at all
This is where a log earns its keep. Without one you are guessing which side failed. The questions are:
- Did WordPress try to send the email?
- Did the sending service accept it?
- Did the recipient's server accept it, or refuse it?
If you use an email log, search for the recipient's address and read the status. If you do not have one, a plugin can record what WordPress sends, but it will only tell you what happened on your side. We cover why that matters in why your WooCommerce and form emails need a log.
The quick reference
| What you see | What it probably means | What to try |
|---|---|---|
| Not in the log, nothing sent | WordPress never sent it | Plugin conflicts, host blocks mail(), form or login plugin settings |
| In the log, status sent | The receiving server took it | Spam folder, wrong address, filters, missing DNS records |
| Bounced | The recipient's server refused it | Check the address for typos, read the reason |
| Failed or blocked | It was not sent | Read the reason on the entry |
If you are locked out right now
Your host can usually reset the password for you, or you can do it through the database or hosting control panel. Do this first, fix the email second.
A note on "sent"
Even when everything is correct, "sent" or "delivered" means the receiving server accepted the message. Which folder it lands in is for the recipient's provider to decide, and nobody can see that from outside. That is why checking spam, and authenticating your domain, matter.
Where SendWP fits
The SendWP plugin routes the email that WordPress sends through wp_mail, and password resets are part of that. Mail goes out from your own domain, signed with DKIM, with SPF and DMARC records spelled out for you and checked. Each email shows up in your log with a status of sent, bounced, failed or blocked and a timeline. If a reset isn't in the log at all, it never reached SendWP, and the troubleshooting guide below shows where to look next.
The SendWP troubleshooting guide walks through the same checks, and you can write to the team through support. Plans start at $9 a month; see pricing or getting started.
