# Password reset link broken: first 30 minutes checklist

Source: https://releasefailures.com/incidents/password-reset-link-broken/
Content version: 1.0.0
Verified on: 2026-10-21
Licence: CC BY 4.0

Definition: Password reset emails link to a wrong or expired route after a routing change.
- [ ] FM-01 Request a password reset on production with a test account and follow the link to see which screen or error it reaches.
- [ ] FM-02 Read the outgoing reset message in the mail log and check that the URL is present, correctly escaped and on the current domain.
- [ ] FM-03 Compare the reset flow on the previous release in the same environment to isolate the change that broke the link.
- [ ] FM-04 If the link host is wrong, correct the application base URL; a code rollback is not needed for that case.
- [ ] FM-05 If the link is malformed or missing, roll back the release that changed the reset template or the link builder.
- [ ] FM-06 Post a notice on the sign-in page that reset emails sent during the incident window do not work and must be requested again.
- [ ] FM-07 Give support staff a manual password reset path for locked-out users until the fix is live.
- [ ] FM-08 After the fix, send a new reset email and confirm its link opens the reset form.