Lost Password

Ignition Crowdfunding ships a frontend lost-password and reset flow so users never see the bare wp-login.php reset screens or the plain-text WordPress-default email.

How a user requests a reset

1. On the auth form, the user clicks Lost password?.
2. The form switches to a single-field “enter your email” screen.
3. After submitting, the user sees a generic acknowledgement — the same wording is shown whether or not an account with that email exists, to avoid leaking account presence.
4. If a matching account exists, the plugin sends a branded HTML email titled “Reset your password for {site_name}” containing a single-use reset link.

The form is enumeration-safe: the success message and HTTP response are identical for known and unknown emails.

How a user completes a reset

The link in the email opens the auth form in reset mode. The user sets a new password (validated by the strength meter — see Account → Changing password) and is logged in automatically on success.

If the link has been used or has expired, the form shows:

This reset link is invalid or has expired. Enter your email address below to request a new one.

A request form is shown inline so the user can start over without leaving the page.

Suppression of the WordPress default email

WordPress’s built-in password reset would normally email a plain-text link to wp-login.php whenever retrieve_password() runs. Ignition replaces this with its own branded HTML email and suppresses the default by filtering retrieve_password_message to an empty string.

This means:

• Users only ever receive the Ignition-branded reset email.
• The reset link goes to the plugin’s frontend reset form, not wp-login.php.
• The “Always on (security)” group in Settings → Emails controls the appearance and copy of the email; the email cannot be disabled.

If a custom plugin or theme also hooks retrieve_password_message and runs at a later priority, that callback will win. Make sure any custom reset email is the only one you want delivered.

Settings

The reset email lives in Ignition > Settings → Emails under the Always on (security) group together with the email-change and password-changed notifications. The group is read-only: the emails cannot be disabled, but the From Name and From Email fields under Sender details apply to them like any other transactional email.

Related

• Email Notifications — All transactional emails the plugin sends
• Email Verification — The activation-link mechanism used for self-registration and guest claim
• Account — Frontend password change from inside the dashboard