Link in Password Reset Email is using http Instead of https

This article explains why the link in the password reset email can sometimes have an http address instead on a https one.

• Email
• Password reset

This can be caused when using the SendGrid email provider and having the click-tracking feature enabled. The feature for click-tracking that is available in SendGrid wraps the password reset link in an http link that looks something like http://url1234.myaccount.com/ls/click?upn... This can cause some browsers to show a pop-up warning that the link is unsafe even if it afterwards it immediately redirects to the normal https password reset page.

Perform one of the following actions within the SendGrid configuration to resolve the protocol mismatch:

• Update the SendGrid configuration to ensure the click-tracking feature uses an $https$ link.

• Disable the click-tracking feature entirely if $https$ wrapping is not supported.