lw-firewall-password-reset-protection
Installation
SKILL.md
LW Firewall password-reset protection
LW Firewall 1.5.1 added a reset-specific guard. Use this skill before changing
a lost-password form, calling retrieve_password() from a custom transport, or
tuning the reset limits.
Activation and hook boundary
The reset guard initializes only when the MU worker is current, master
enabled is true, and reset_protect_enabled is true. It registers:
| Hook | Role |
|---|---|
lostpassword_form |
render lw_fw_reset_token and lw_fw_confirm_url on core wp-login.php |
lostpassword_post |
apply proof decision and three rate-limit axes before mail |
allow_password_reset |
optionally refuse every privileged account when reset_block_admins is on |