Form Security
CAPTCHA Presence on Password Reset Form Check
Password reset pages can be abused by bots. Learn how to protect this form with a CAPTCHA to prevent mass account access attempts.
What this test checks
This test checks whether your password reset form is protected by a CAPTCHA. Without it, attackers can automate reset requests to harass your users, saturate your email system, or attempt to take over accounts by exploiting potential weaknesses in the reset process.
Our recommendation
Protect your password reset form with a CAPTCHA. Use a request‑limiting mechanism (e.g., 3 attempts per hour). Ensure reset emails contain a secure link with a short validity period (e.g., 15 minutes). Notify the user by email for every reset request.
Security tests
Read more
Form Security