Login and password reset forms

Two form kinds that replace wp-login.php with pages you designed. Both are open to anyone by definition, neither collects visitor details, and neither sends notifications — they have their own emails and messages instead.

Login forms

Create one: VX Modules → Forms → Add form → Login form.

The palette is short: Email or username, Password, Remember me, and the layout blocks. A new login form starts with all three.

After logging in

Setting	Options
Then	Stay on this page · Show a message · Go to a page
Message	Shown in place of the form
Page URL	Where to go. Smart codes work here
Send them back where they were	The page the login link asked for (a redirect_to in the address) or, failing that, the page they came from. Only pages on this site
That wins over the settings here	On: back where they were, even when a page or a role page is set. Off: the page and role settings win, and back applies only when none match
A page per role	Send some roles somewhere else. The first matching row wins

Stay on this page reloads it, which is usually what a login form in a header wants.

Already logged in

Setting	Options
When a logged-in visitor sees the form	Show a note with a logout link · Show nothing
The note	The wording, with {user_name} available

Links under the form

Setting	Options
Forgot password	The password reset form's page · WordPress's own reset page · An address · Off
Create an account	No link · The registration form's page · An address

Pointing at the reset form's page or the registration form's page means you can move those pages without editing this form. Choose a specific form, or leave it on the first one seen on a page and the link follows whichever is in use.

Tries

Setting	What it does
Failed attempts allowed	Per visitor. 0 means no limit. Default 5
per	A number and a unit: minutes, hours, or days. Default 15 minutes
Message	What they see when they are over the limit

The visitor is identified by network address, and that address is kept only as a hash. A successful login clears the count.

Wrong details read the same either way

The Wrong email or password message is used whether the account exists or not, so a login form cannot be used to discover which addresses have accounts.

Taking over the site's login links

Use this form's page for them routes every Log in link WordPress or a plugin builds to this page instead of wp-login, carrying along where to go afterwards. The page is remembered the first time the form is viewed there.

wp-login.php itself still works if you ever need it.

One take-over at a time

Two forms both taking over the login links would fight. Duplicating a form switches the take-over off in the copy for that reason.

Password reset forms

Create one: VX Modules → Forms → Add form → Password reset form.

One page does both steps:

1. Ask for a link. The visitor enters an email or username and gets an email.
2. Choose a new password. Opening the link returns them to the same page on step 2.

The palette has one field per step — Email or username and New password — plus layout blocks.

The email

Setting	What it does
Subject and message	Must contain {reset_link}

The link opens this form's page on step 2 and expires the way WordPress's own reset links do.

New password

Setting	What it does
Shortest allowed	Minimum characters
Must include	An uppercase letter, a number, a symbol
Ask to type it twice	Adds a confirm box
Step 2 button	Its label. Step 1 uses the form's own button label

These are the same rules a registration form applies, listed under the box and checked on the server.

After the password is changed

Setting	Options
Then	Show a message · Go to a login form · Go to a page
Log them in	Sign the person in with the new password and send them on

Messages

Message	When
After the link is sent	Step 1 succeeded. The same wording whether the account exists or not
After the password is changed	Step 2 succeeded
The link is old or used	Shown above step 1, so they can ask again
Too many requests	Over the limit

Limits

Setting	What it does
Requests allowed	Per visitor. 0 means no limit. Default 3
per	Default 15 minutes

The address is kept only as a hash. The limit is what keeps a script from flooding a mailbox.

Taking over WordPress's own reset

Take it over points every Lost your password? link on the site — including the one on wp-login — at this form's page, and rewrites the link in WordPress's own reset email to come here too. The page is remembered the first time the form is viewed there.

Placing them

Same as any form: [vx_form id="…"], the VX Form block, the Elementor widget, or the Bricks element. A login form in a header works well; a reset form usually wants a page of its own, because the reset link has to land somewhere.