Typical scenario: users log in on the front-end and have a profile page where they can update their info, including changing their current password.

I have referenced this article from 2014 but it's not working for me; maybe it's outdated by now?

Is it possible to change a user's password in the front-end?

From that article I get:

  1. User needs to be logged in
  2. User needs to submit their current password (input name="password")
  3. User needs to add a new password (input name="newPassword")

I've done all of this in my code and it does not work. For simplicity's sake, I've even copied and pasted the code from the link posted above but it does not work. I've created a fake user called "Mister Test" with a password of "purple"; if I try to change the password on the front end to something like "test123", it does not redirect to my success url and does not change the password.

I don't know what else to do. Not much coming up in google searches. My original code is below:

<form method="post" accept-charset="UTF-8">
    {{ getCsrfInput() }}
    <input type="hidden" name="action" value="users/saveUser">
    <input type="hidden" name="redirect" value="/">
    {# redirecting to homepage just for testing #}
    <input type="hidden" name="userId" value="{{ currentUser.id }}">

    <label for="currentPassword">{{ "Current password"|t }}</label>
    <input type="password" name="password" id="currentPassword">

    <label for="newPassword">{{ "New password"|t }}</label>
    <input type="password" name="newPassword" id="newPassword">

    <button class="btn" type="submit">{{ "Save"|t }}</button>
  • For what it is worth, I have a password update feature on one of my sites and it works fine, using the same field names as you. Re: the redirect, since you are using a query parameter, did you create a route to handle the query string?
    – Roi Agneta
    Commented Jun 20, 2016 at 17:08
  • The query string doesn't matter. Like I said, at one point I used the code from the article I posted to see if anything in my code was a typo or whatever, and just now I did a test trying to redirect to the homepage but the form simply doesn't submit. The page refreshes but doesn't change the password.
    – Ryan
    Commented Jun 20, 2016 at 17:17
  • Is your form checking for errors on the UserModel? The behavior you're seeing sounds like a validation error is happening.
    – Brad Bell
    Commented Jun 20, 2016 at 17:42
  • It's not checking for errors (or not that I know of, at least). I'm testing with the stripped down code you see above and redirecting to the homepage, but when the form submits, it just refreshes and keeps me on the user profile page with no password change. Are the names of the inputs listed above correct? Is there something specific I can search for in the logs? (I'm terrible at reading the logs)
    – Ryan
    Commented Jun 21, 2016 at 11:08
  • Oooook, I figured out what's the matter. It's because I'm using this Craft-Password-Confirm plugin to ensure the right password gets submitted on registration. However, the plugin is set to always check an input with a name of "confirmPassword" against another input called "password". In this case, however, since it's an update password form, I have both of those fields plus the "newPassword" field.
    – Ryan
    Commented Jun 21, 2016 at 15:51

1 Answer 1


Sounds like it might be a form submission issue rather than anything related to password /profile updates. I ran into a similar issue a while ago and resolved it by disabling Suhosin on my server. May want to give that a try.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.