Change record status: 
Project: 
Introduced in branch: 
8.8.x
Introduced in version: 
8.8.0
Description: 

The password reset form now has flood control on it.

Flood control prevents abuse by limiting the number of requests by IP address or an account within a rolling time interval.

If flood control is triggered Drupal will emit the following form errors:

Too many password recovery requests from your IP address. It is temporarily blocked. Try again later or contact the site administrator.

or

Too many password recovery requests for this account. It is temporarily blocked. Try again later or contact the site administrator.

Default flood settings are:

Name Limit
ip_limit: 50
ip_window: 3600
user_limit: 5
user_window: 21600

A successful password reset clears flood events for that user.

If you require more control, you can consider using https://www.drupal.org/project/flood_unblock

Impacts: 
Site builders, administrators, editors