> For the complete documentation index, see [llms.txt](https://kb.craftformswp.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kb.craftformswp.com/documentation/form-building/create-form/form-settings-post-context/submit-actions/account-forms.md).

# Account Forms: Register, Log In, Reset Password

With CraftForms you can build the account pages of a members' area as normal forms on your own pages: a sign-up form that creates a WordPress user, a log-in form, and the two forms that reset a forgotten password. They look like the rest of your site instead of the WordPress login screen, and they use WordPress's own sign-in and reset underneath, so your security plugins keep working.

| Form          | Action it uses        | What it does                                                    |
| ------------- | --------------------- | --------------------------------------------------------------- |
| Sign-up       | **User Registration** | Creates a WordPress user from the answers.                      |
| Log in        | **Log In**            | Signs the visitor in with their username or email and password. |
| Lost password | **Lost Password**     | Emails a link to choose a new password.                         |
| New password  | **New Password**      | Opened from that link: sets the new password.                   |

### What you need

* **CraftForms PRO**, version 2.3 or later. In the free version the four actions are listed with a **PRO** badge and can't be used.
* WordPress pages for the forms, for example `/join/`, `/log-in/`, `/lost-password/` and `/new-password/`.
* Your site must be able to send email (for the reset link). See [SMTP tips](/documentation/email-templates/smtp-servers-tips.md).

![The Select Action Type window in the free version, with Log In, Lost Password and New Password marked PRO](https://97821998-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FM2yV1foUgoGHBC66VBDw%2Fuploads%2FMhud8eVwHfA7QnD7r4N5%2Faccount-forms--free-pro-actions.jpg?alt=media)

### Start from the starters

Log In, Lost Password and New Password each have a ready-made form:

1. Go to **CraftForms → Forms → Add New**.
2. In **Choose a starter**, type **password** in the search box.
3. Pick **Log In**, **Lost Password** or **New Password**, give the form a title and publish it.
4. Place each form on its own page.

![Choose a starter, searching for password: Log In, Lost Password and New Password](https://97821998-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FM2yV1foUgoGHBC66VBDw%2Fuploads%2FhMFLx6mVytonHxl6YhyR%2Faccount-forms--starters.jpg?alt=media)

Then connect them, in this order:

1. **New Password** page first. Copy its address, for example `https://example.com/new-password/`.
2. Open the **Lost Password** form, select the **Form** tab, open **Submit Actions** and edit **Lost Password**. Paste the address into **Page with the New Password form (optional)** and save.
3. Open the **Log In** form. Its text "Forgot your password?" links to `/lost-password/`. Select the link and change it if your Lost Password page has another address.

There is no starter for the sign-up form: every site asks for different details. See [Build a sign-up form](#build-a-sign-up-form) below.

### Build a sign-up form

1. Create a form with at least an **Email** field. Add a **Password** field (a Text Input Field with **Input Type** set to **Password**) if members choose their own password, plus anything else you need: first and last name, a [Consent](/documentation/form-building/create-form/blocks/consent-field.md) box for your terms.
2. Optional: add a hidden field that [generates a member number](/documentation/form-building/create-form/blocks/generated-reference-numbers.md), like `MEM-{YYYY}-{0001}`.
3. Select the **Form** tab, open **Submit Actions**, click **Add Action** and choose **User Registration**.
4. Pick the **Default User Role**. Only roles that can't manage the site are offered; **Subscriber (lowest)** is the safe choice.
5. Under **Field Mappings**, choose a form field for **Username (required)** and **Email Address (required)**. Using the email field for both is fine: members then log in with their email address.
6. Click **+ Add Mapping** for each other detail: your password field → **Password**, first name → **First Name**, the member number → **Custom User Meta** with a **Meta Key** such as `member_number`.
7. Choose what happens **If the account already exists** (see below), and whether to **Send welcome email**.
8. Save the action, add **Save Submission** and a **Send Email** action if you want them, and save the form.

![User Registration mappings: email to username and email, password, first name, and the member number as custom user meta](https://97821998-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FM2yV1foUgoGHBC66VBDw%2Fuploads%2Fs0dFUIrOtFhhFsSPP80o%2Faccount-forms--user-registration-mappings.jpg?alt=media)

Without a password mapping, WordPress makes a random password; turn on **Send welcome email** so the member gets WordPress's link to set their own.

#### User Registration settings

| Setting                           | What it does                                                                                                                                                        |
| --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Default User Role**             | The role every new account gets. Administrator, Editor and other roles that can manage the site are never offered and never given, whatever is sent.                |
| **Field Mappings**                | Which form field (or a fixed **Static value**) fills each user detail. **Username** and **Email Address** are required. **User Role** can only take a static value. |
| **If the account already exists** | See below. Default: **Refuse the form, and tell the visitor**.                                                                                                      |
| **Send welcome email**            | Sends WordPress's own new-user email to the member (and the admin notice).                                                                                          |

#### If the account already exists

CraftForms checks for an account with the same email address or username **before any action runs**. You choose what happens:

| Option                                             | What happens                                                                                                                                                                                                                                                                                                          |
| -------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Refuse the form, and tell the visitor**          | Nothing is saved, emailed or charged. The visitor sees a message on the email field: *There is already an account with this email address. Please log in, or reset your password if you have forgotten it.* For a taken username: *This username is already taken. Please choose another one.*                        |
| **Update the account, if it is the visitor's own** | For a member who is logged in to that account: their names, website, description and mapped custom fields are updated (a renewal form, for example). The password, email address, username and role are never changed, and a generated member number already on the profile is kept. Anyone else is refused as above. |
| **Accept the form without making an account**      | The form goes through and the other actions run, but no account is made or changed.                                                                                                                                                                                                                                   |

![If the account already exists setting](https://97821998-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FM2yV1foUgoGHBC66VBDw%2Fuploads%2FD6w9DHyOCnH0P7YDW5xu%2Faccount-forms--if-account-exists.jpg?alt=media)

![The sign-up form refused with "There is already an account with this email address" on the email field](https://97821998-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FM2yV1foUgoGHBC66VBDw%2Fuploads%2F5mnCqwC5QGKoH9rP1IQ4%2Faccount-forms--account-exists-error.jpg?alt=media)

### Log In

![Log In action settings](https://97821998-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FM2yV1foUgoGHBC66VBDw%2Fuploads%2FcRxbfooDVUwFxhN732Zs%2Faccount-forms--log-in-settings.jpg?alt=media)

| Setting                            | What it does                                                                                                                                                                  |
| ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Username or email field**        | The **Field Name** of the field where the visitor types their username or email. Starter: `login`.                                                                            |
| **Password field**                 | A field whose **Input Type** is **Password**. Starter: `password`.                                                                                                            |
| **"Remember me" field (optional)** | A checkbox or Consent field. Ticked: the visitor stays signed in for two weeks. Otherwise until they close the browser.                                                       |
| **After signing in, go to**        | An address on your site, such as your members' page. Empty: the same page reloads, now signed in. A **Redirect URL** in the form's **After Submission** settings comes first. |

A wrong username, email or password always gets the same message, on the password field: *The username, email or password is not right. Please try again.* It doesn't say which one was wrong.

![The log-in form after a wrong password](https://97821998-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FM2yV1foUgoGHBC66VBDw%2Fuploads%2FTRscd2EwmWZFr7i8d98j%2Faccount-forms--log-in-wrong-password.jpg?alt=media)

**Tip:** with **After signing in, go to** empty, the page reloads with the log-in form still on it. Set it to your members' page, so a signed-in member lands somewhere useful.

### Lost Password

![Lost Password action settings](https://97821998-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FM2yV1foUgoGHBC66VBDw%2Fuploads%2FM6EjmLRkuJR58U3cBTFk%2Faccount-forms--lost-password-settings.jpg?alt=media)

| Setting                                        | What it does                                                                                                               |
| ---------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| **Username or email field**                    | The field where the visitor types their username or email. Starter: `login`.                                               |
| **Page with the New Password form (optional)** | The address of your New Password page. The link in the email opens it. Empty: the link opens WordPress's own reset screen. |

WordPress sends its usual **Password Reset** email. The visitor always sees the same answer, whether or not there is an account, so the form can't be used to find out who is a member. The starter's message: *If there is an account with that username or email, we have sent a link to choose a new password. Please check your inbox.*

### New Password

![New Password action settings](https://97821998-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FM2yV1foUgoGHBC66VBDw%2Fuploads%2FZvkgFPq24mdSWT8vfUBU%2Faccount-forms--new-password-settings.jpg?alt=media)

| Setting                              | What it does                                                                          |
| ------------------------------------ | ------------------------------------------------------------------------------------- |
| **New password field**               | The password field for the new password. Starter: `password`.                         |
| **Repeat password field (optional)** | A second password field. The two must match: *The two passwords are not the same.*    |
| **Reset key field**                  | A hidden field with the default value `{{query.key}}`: the key from the emailed link. |
| **Username field**                   | A hidden field with the default value `{{query.login}}`.                              |
| **Shortest password**                | The fewest characters allowed. Default 8.                                             |

![The New Password form with two passwords that don't match](https://97821998-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FM2yV1foUgoGHBC66VBDw%2Fuploads%2FyFLkwjjcG26VQ6XCBGzM%2Faccount-forms--new-password-mismatch.jpg?alt=media)

When the password is saved, the member is signed out on every device and can log in with the new password. Each link works once and for a limited time (WordPress's own rule, 24 hours by default). An old or used link gets: *This reset link has expired or was already used. Please ask for a new one.*

### Passwords are never stored

* What a visitor types into a **Password** field is never saved with the submission and never shown in **CraftForms → Submissions**, emails, webhooks, flows or PDFs, in any form. Only **User Registration**, **Log In** and **New Password** receive it, for that one request.
* The reset key from the email is treated the same way.
* Log In, Lost Password and New Password don't save a submission at all. Add **Save Submission** only to the sign-up form.
* A form left half-filled ([abandoned form capture](/documentation/form-building/abandoned-form-capture.md)) never keeps password fields.

### Security

* **WordPress's own sign-in and reset.** Lockout and limit-login plugins count attempts on your form as they do on the login page, and their messages are shown on the form.
* **Two-factor sign-in.** On a site with a two-factor plugin (Two Factor, Wordfence Login Security, WP 2FA, Solid Security, Two Factor Authentication, miniOrange), accounts that use it are told to log in on the WordPress login page, with a link to it. Developers can answer for other plugins with the `craftforms_login_two_factor` filter.
* **Only on your own site.** Log In works on your site's pages. A form [embedded](/documentation/form-building/embed.md) on another website, or opened from a full-screen link there, can't sign anyone in: the visitor gets a link to your login page.
* None of the four actions can run in a [flow](/documentation/form-building/flows.md): they need the visitor's own visit.

### Good to know

* **Accounts on CraftForms Cloud:** User Registration isn't available on hosted forms.
* WordPress's own login page still works. To send everyone to your new pages, use a plugin or your theme to change the login and lost-password links.
* The starters' Confirmation messages and field labels are normal blocks: change the wording as you like.