Well-known change-password URL

A redirect at /.well-known/change-password pointing at the site's own change-password page, so a password manager can offer to rotate a saved password in one click. Only useful on a site with accounts, so the row only appears where the scan found a sign-in — a password field or a link to one.

• Help center

/.well-known/change-password is a W3C convention that lets password managers send users straight to the page where they can change their password. When a manager finds a weak, reused or leaked password, it can offer a "Change password" button that opens exactly the right page instead of leaving the user to hunt through account settings. Safari, Chrome, 1Password and other managers support it.

The address is not a page itself — it is defined as a redirect to wherever your site actually handles password changes.

How SiteScan checks

This row appears only if the crawl found something to sign in to: a password field or a link to a login page. On sites without accounts the address is not requested at all. The scan asks for /.well-known/change-password without following redirects and counts it as published when the answer is a 3xx with a non-empty Location header. A 200 page, a 404 or a redirect-less answer reads as not published. It is optional, so absence is never shown as an error.

How to set it up

Add one redirect rule, for example in nginx location = /.well-known/change-password { return 302 /account/password; }, or Redirect 302 /.well-known/change-password /account/password in Apache. If changing the password requires being logged in, point it at the page anyway; the site's own login redirect will handle the rest. See also security.txt.