Title: Spurious password reset request
Last modified: December 26, 2020

---

# Spurious password reset request

 *  [NL_Derek](https://wordpress.org/support/users/nl_derek/)
 * (@nl_derek)
 * [5 years, 8 months ago](https://wordpress.org/support/topic/spurious-password-reset-request/)
 * I run a small and newish WordPress site in the Netherlands. Today (26 Dec) I,
   as webmaster, received an email from WordPress asking for a password reset. The
   email says “if this is a mistake, you can ignore this email”. The request came
   from an IP in Germany, and our site is strictly Dutch.
 * Our Contact page gives my webmaster email address, but as an inline PNG with 
   a `mailto:` link, to avoid scraping.
 * I did some tests and it looks as if somebody clicked “forgot password” and filled
   in the webmaster email address. Easy enough for a human, but a robot would need
   to be quite sophisticated to extract the email address and use it correctly. 
   And our website (sustainable living in the city center) is hardly a high-value
   target. I have looked over the site and see no visible changes. I receive some
   spam but Akismet keeps it under control.
 * I assume it is some sort of hacking attempt, but cannot understand how it was
   intended to work. If the hacker has compromised my email provider then s/he can
   break in without my knowledge, and if not I see no possible advantage.
 * Can I safely ignore the incident? How did the hacker intend to proceed?
    -  This topic was modified 5 years, 8 months ago by [NL_Derek](https://wordpress.org/support/users/nl_derek/).
      Reason: Grammar
 * The page I need help with: _[[log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fspurious-password-reset-request%2F%3Foutput_format%3Dmd&locale=en_US)
   to see the link]_

Viewing 4 replies - 1 through 4 (of 4 total)

 *  [corrinarusso](https://wordpress.org/support/users/corrinarusso/)
 * (@corrinarusso)
 * [5 years, 8 months ago](https://wordpress.org/support/topic/spurious-password-reset-request/#post-13835395)
 * I don’t see how an inline png with a mailto: tag on it would obscure anything?
   
   Also, your address is open : [https://www.binnenstadduurzaam.nl/contact/](https://www.binnenstadduurzaam.nl/contact/)
 * Personally, I would ignore it/
 * If you are worried, then harden your site :
    [https://www.wordfence.com/blog/2017/10/should-you-hide-wordpress-login-page/](https://www.wordfence.com/blog/2017/10/should-you-hide-wordpress-login-page/)
 * > [Hardening WordPress](https://wordpress.org/support/article/hardening-wordpress/)
 *  Moderator [t-p](https://wordpress.org/support/users/t-p/)
 * (@t-p)
 * [5 years, 8 months ago](https://wordpress.org/support/topic/spurious-password-reset-request/#post-13835426)
 * Also, you may want to implement some (if not all) of [the recommended security measures](https://wordpress.org/support/article/hardening-wordpress/)
   and [start backing up your site](https://wordpress.org/support/article/wordpress-backups/).
 *  Thread Starter [NL_Derek](https://wordpress.org/support/users/nl_derek/)
 * (@nl_derek)
 * [5 years, 8 months ago](https://wordpress.org/support/topic/spurious-password-reset-request/#post-13837382)
 * [@corrinarusso](https://wordpress.org/support/users/corrinarusso/) the trick 
   with the inline PNG is to stop simple robots from harvesting your email; 15 years
   ago I took over a website which was receiving several spams per day (mostly from
   Nigerian millionaires those days); replacing the existing `mailto:` link with
   a PNG (screenshot of the link) reduced that to a few per week. It has the same
   aim as writing `johnDOTsmithATcompanyDOTcom`, but IMHO looks nicer and is more
   user-friendly.
 * As to security, I make backups and am reasonably security-aware, but my site 
   is not likely to be a target of anything other than widespread robot-attacks.
   That is why I was surprised to see what looks like a human attack.
 *  [corrinarusso](https://wordpress.org/support/users/corrinarusso/)
 * (@corrinarusso)
 * [5 years, 8 months ago](https://wordpress.org/support/topic/spurious-password-reset-request/#post-13837411)
 * > the trick with the inline PNG is to stop simple robots from harvesting your
   email
 * Yes. I understand the details. My point is that it won’t stop harvesters. A mailto:
   is still visible. Whether it is on an image or not.
 * > As to security, I make backups and am reasonably security-aware
 * Backups are not a method of security. Many infections won’t show up for quite
   some time (days, weeks, months). So you could be simply making backups of infected
   sites. Suggest running a daily scan for malware, and let your host manage backups.
 * If you want to stop spam, build contact forms with a strong reCaptcha.

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘Spurious password reset request’ is closed to new replies.

## Tags

 * [password reset](https://wordpress.org/support/topic-tag/password-reset/)

 * In: [Everything else WordPress](https://wordpress.org/support/forum/miscellaneous/)
 * 4 replies
 * 3 participants
 * Last reply from: [corrinarusso](https://wordpress.org/support/users/corrinarusso/)
 * Last activity: [5 years, 8 months ago](https://wordpress.org/support/topic/spurious-password-reset-request/#post-13837411)
 * Status: not resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics