I'm using EE 2.7.3 and would like to know if it's possible to increase the default expiration time (24 hours) on the outgoing link in the reset password routine.

Any help much appreciated.


1 Answer 1


No, that is not configurable. Typically, 24 hours should be sufficiently long, and any longer would start to introduce security issues. The user triggering the action is doing so to reset their password now, not some time in the future (or shouldn't be, anyway).

If an active code were to sit in their inbox for many days, for instance, that increases the chance that someone with access to that email (shared account, walking away from a desk, etc.) could intentionally or accidentally reset their password and gain control of their account.

  • That's a lot for that Derek - makes a lot of sense! Commented Jul 21, 2014 at 6:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.