I see that in Member Management Module, there is a Login Form Tag that allows you to place a login form in any template you choose.

Is there a similar tag for the password reset form?

4 Answers 4


Take a look at Authenticate, it's my add-on that makes forgot password forms and login forms much better. https://objectivehtml.com/authenticate/examples#forgot

There are other add-ons too like FreeMember, but have never personally used it. http://devot-ee.com/add-ons/freemember

  • what does {exp:authenticate:login_form} provide that {exp:member:login_form} doesn't? Is there no native way for EE to customize password reset? Also, noticed in your sample code that auth_type='email' is written twice. Typo? Commented Dec 19, 2012 at 4:35
  • Thanks for pointing that out. Definitely a typo. I used that page to make my syntax highlighter and added every variation of syntax I could think of. I left some stuff in there by mistake. It will be removed with my next deployment. Commented Dec 19, 2012 at 4:51
  • But to answer your question, it adds inline error handling and removes that ugly redirect screen. You can alter the email contents, but you have to modify SQL rows in a the exp_specialty_templates table. Commented Dec 19, 2012 at 4:52
  • I think there is a problem with return parameter. Every time I submit the form, it redirects me to the same URL sans index.php. I've even tried changing it to http://www.google.com just to see if it would take me there on successful login. It doesn't. I'm always redirected to the same page without the index.php. I'm guessing there is some error in what I am submitting and I'd see the errors if it redirected me to the correct page. Would give me an idea of what I'm doing wrong. Commented Dec 19, 2012 at 5:16
  • Ok, thanks I will take a look into it tomorrow. It know it works (I use it all the time), so I will double check everything. I am sure it's a bug, just I haven't noticed it. Commented Dec 19, 2012 at 5:19

You can actually copy the rendered code from the password reset form to recreate it in any template.

<div id="content">
<form id="forgot_password_form" method="post" action="http://www.mydomain.org/"  >
<div class='hiddenFields'>
<input type="hidden" name="XID" value="3a451c89545c8d3044192ebd6aeb00c5114d2e04" />
<input type="hidden" name="ACT" value="11" />
<input type="hidden" name="RET" value="-3" />
<input type="hidden" name="FROM" value="" />
<input type="hidden" name="site_id" value="1" />

<table class="tableborder" cellpadding="0" cellspacing="0" border="0" style="width:560px;" align="center">
<td class="profileHeadingBG" colspan="2"><div class="tableHeading">Forgotten Password</div>


<td class="tableCellOne" colspan="2">

<h3>Your Email Address</h3>

<p><input type="text" name="email" value="" class="input" maxlength="120" size="40" style="width:100%" autocomplete='off' /></p>

<p><input type="submit" value="Submit" class="submit" /></p>

<p><br /><a href="http://www.mydomain.org/subscriber/login">Back to Login</a>



Is the relevant portion of the code, though you probably want to at least explore the styles in the original, as well. I believe this is one of the forms, where though an XID is generated, but the security risk isn't that high if it stays they same.

If you're very security minded, then you can use a number of add-ons to get more control, and they'll make sure a new XID is generated every time the form is called. You could also create a php script that generates an XID.

I've used Solspace's User, Authenticate, and Zoo Visitors to handle the creation of registration, login and password forms before. But I recall that in the first project that I had that actually required a custom members area (most of the sites we develop don't), we tested the password rest form and decided the code grab-able.

It's been awhile, but I think we looked to see if the XID was being used to identify the user, but for the site, the front end only used cookies and since the user hadn't logged no session was in play and the other security risks were minimal. Granted, I don't recall, what the other security risk were now. That was +5 years ago, I believe. Right before add-ons customizing the member templates started to show up.

Update. Remember to copy the code from your solution. I do believe whatever you use for the XID needs to match your system, but I could be wrong.

EDIT By Anna Brown
You can use {xid_hash} to generate a unique hash per page load.

  • This is a great solution!
    – Anna_MediaGirl
    Commented Dec 19, 2012 at 5:48
  • Excellent! Yes, please use {xid_hash} Commented Dec 19, 2012 at 6:11
  • The ACT value may vary in your installation as well, though it's fairly standard. Commented Nov 14, 2013 at 4:54

There is not a native tag for outputting the "forgot password" form into an EE template.

A "creative" option would be to strip down the native member template to bare minimum HTML and load the form into your template using jQuery.

JS would look like this:


HTML would look like this:

<div id=""></div>

The tag to access the native EE forgot password template is {path='member/forgot_password'} OR replace "member" with the member profile trigger word you have set in your CP. Or just use "/member/forgot_password".


Sorry it is late.

You dont really have to worry what are the tags since EE is really restricted with those pages

Simply edit files in

themes/profile_themes/default/reset_password_form.html themes/profile_themes/default/html_header.html (If you want it to look pretty)

I was in the same boat with you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.