---
title: "Point to the change-password page · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/standard-addresses/change-password
updated: 2026-10-20
licence: "All rights reserved"
---

# Point to the change-password page

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Optional
- Chapter: [Standard addresses](https://agentwranglers.se/playbook/website/standard-addresses)
- Rule: If people have accounts, redirect `/.well-known/change-password` to the page where they change their password.
- How: Answer the address with a temporary redirect (302, 303 or 307) to your change-password page, as the W3C change-password draft sets out. Make sure unknown addresses answer 404. Browsers first fetch `/.well-known/resource-that-should-not-exist-whose-status-code-should-not-be-200` and trust the redirect only if that answers 404.
- Check: `curl -sI https://example.com/.well-known/change-password` shows a 302, 303 or 307 with a `Location` on the password page. The test address above returns 404.

Example:

```nginx
location = /.well-known/change-password {
  return 302 https://example.com/account/password;
}
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/standard-addresses/change-password`.

- Previous: [Serve standard files at fixed addresses](https://agentwranglers.se/playbook/website/standard-addresses/well-known-overview)
- Next: [List the sites that share passkeys](https://agentwranglers.se/playbook/website/standard-addresses/webauthn)
- [Standard addresses](https://agentwranglers.se/playbook/website/standard-addresses)