News
change-password well-known vs a Custom /reset URL
June 23, 2026
change-password well-known vs a custom /reset URL is a pointer versus the actual form. WICG / RFC 8615 well-known URIs put a redirect at https://example.com/.well-known/change-password so browsers and password managers can find 'change password' without guessing /account/security. The destination still needs session auth, CSRF controls, and no reset tokens in the URL. Missing the well-known path is a convenience gap, not an OPSEC F. A reset link with the token in the query string is the miss — see open redirects vs tokens in URLs. RoastMyOpsec does not require change-password. It may probe other well-known sensitive paths for signatures. It does not submit password-change forms.
The practical difference
The well-known URL is a stable address. Your product URL can move; the well-known entry redirects. /reset, /forgot, and /wp-login.php?action=lostpassword are product paths. Password managers look up well-known first.
security.txt is for researchers. change-password is for users' password tools. Do not mix the two files.
How to choose what to publish
If you have a logged-in change-password page, add a 302 from /.well-known/change-password to that HTTPS URL (same site). If you only have email reset, point at the reset request page — not a URL that already contains a token. If you have no accounts, skip the file.
| URL | Audience | Must not contain | Takeaway |
|---|---|---|---|
| /.well-known/change-password | Password managers | Secrets; open redirects off-site | Redirect to the real form |
| /account/password | Logged-in humans | The old password in a GET | CSRF + session + HTTPS |
| /reset?token= | Email click | Long-lived tokens in Referer logs | See tokens-in-URLs guide |
| /.well-known/security.txt | Researchers | VPN hostnames | Different well-known; see security.txt |
What the roast will not do
No password-change POST, no token redemption. A 404 on change-password is not a finding. An open redirect from well-known to another registrable domain would be a trust-boundary issue if we followed it — keep the hop on your host.
Common mistakes
The first mistake is well-known pointing at http://.
The second mistake is putting the reset token in the well-known Location.
The third mistake is treating a missing change-password file like a missing CSP.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Do I need /.well-known/change-password to pass a roast?
- No. It is a password-manager convenience. The roast does not score it as a vulnerability.
- Can change-password be a 200 HTML page instead of a redirect?
- A redirect to the real UI is the usual pattern. A 200 is fine if that page is the form and stays on your origin.
- Is this the same as security.txt?
- No. security.txt is disclosure contact. change-password is where users change credentials.