The Reset Message
The reset message is one of the few your users are guaranteed to read, and it arrives at a moment of mild frustration. It is worth getting right.
Where to find it
Architect Panel → Configuration:
- Site Settings — the e-mail account and template used for resets
Architect Panel → Layout & Pages:
- E-mail Templates — the template itself
- E-mail Designs — its appearance
What it must contain
- Who it is from, unmistakably.
- What it is for — a password reset somebody requested.
- The link, prominent and obvious.
- How long the link is valid.
- What to do if they did not request it.
State the expiry
People do not act immediately. Saying the link is valid for twenty minutes sets the expectation and prevents the commonest support call — somebody clicking an expired link and concluding the system is broken.
Say what to do if they did not ask
An unrequested reset message means somebody is trying to get into that account. Tell the recipient plainly: ignore the message, their password is unchanged, and contact you if it keeps happening.
That last part matters — repeated unrequested resets are an early warning of a targeted account, and the recipient is the only person who knows they are happening.
Do not include the password
Obvious, and still worth stating. The message carries a link to set a new one; it never carries a password.
Keep it plain
Heavy design, marketing content and multiple links all make the message look less trustworthy and more like phishing. A short, plain, clearly branded message gets used; an elaborate one gets reported as suspicious.
It also survives better in text-only clients and screen readers, which matters for a message that must work for everybody.
Make the link a link
Some clients do not render buttons well, and some users copy the address rather than clicking. Include the link in a form that can be copied, and do not rely on a styled button alone.
Send from a recognisable address
An address at your own domain, matching what users expect. A reset from an unfamiliar third-party sending domain is exactly what a phishing attempt looks like, and cautious users will not click it.
Check it in real clients
Send it to yourself in the mail clients your users actually use — including a phone — and read it as somebody who is slightly annoyed and in a hurry. That is the real test.
Worked example
A team rewrites their reset e-mail to four short lines: what it is, the link, "this link expires in 20 minutes", and "if you did not request this, ignore this message — your password has not changed". Reset-related support enquiries fall away, and two users later report repeated unrequested resets, which turns out to be a targeted account.
Recommendations
- State the expiry in the message.
- Tell people what to do if they did not request it.
- Keep it plain and send from your own domain.
- Test it on a phone before shipping it.