Disabling Password Recovery for Administrators
This setting is used to enhance security: users with access to the admin panel (including administrators and managers) should not be able to recover their passwords through the standard recovery form. This eliminates the risk of account takeover via email access.
How to Disable Password Recovery
Go to the user management section (under "Users").
Find all users with the role:
Administrator
Manager (or any other role with admin access).
Open each user's profile.
Locate the "Password Recovery" setting.
Set the value to "No" (to disable it).
Save the changes.
How to Verify That the Setting Worked
Attempt to initiate the password recovery process for such a user through the login form.
The system should deny the recovery (displaying a message that the feature is unavailable).
Recommendations
Use 2FA (two-factor authentication) for all users with admin access.
For password resets, administrators should manually change the password through the admin panel or directly edit it in the database.
Check this setting after adding new users with admin access rights.
Last updated