DATE_SUB(NOW(), INTERVAL 1 HOUR)"; $rateRow = $db->query($rateSql)->fetch_assoc(); // Per-email rate limit check is done below after we know the user exists if (!$error) { $table = ''; if ($type === 'client') $table = 'users'; elseif ($type === 'rider') $table = 'riders'; elseif ($type === 'restaurant') $table = 'restaurants'; elseif ($type === 'admin') $table = 'admins'; $stmt = $db->prepare("SELECT * FROM $table WHERE email = ? LIMIT 1"); $stmt->bind_param("s", $email); $stmt->execute(); $user = $stmt->get_result()->fetch_assoc(); if ($user) { $token = bin2hex(random_bytes(32)); $expires = date('Y-m-d H:i:s', time() + 3600); // ── Per-email rate limit: max 3 requests in last hour ── $emailRateStmt = $db->prepare("SELECT COUNT(*) as cnt FROM password_resets WHERE user_id = ? AND user_type = ? AND created_at > DATE_SUB(NOW(), INTERVAL 1 HOUR)"); $emailRateStmt->bind_param('is', $user['id'], $type); $emailRateStmt->execute(); $emailRateRow = $emailRateStmt->get_result()->fetch_assoc(); if (intval($emailRateRow['cnt']) >= 3) { $error = "Too many reset requests. Please wait 1 hour before trying again."; } else { $insert = $db->prepare("INSERT INTO password_resets (user_type, user_id, token, expires_at) VALUES (?, ?, ?, ?)"); $insert->bind_param("siss", $type, $user['id'], $token, $expires); if ($insert->execute()) { $resetLink = SITE_URL . "/reset-password.php?token=$token"; $userName = $user['name'] ?? $user['full_name'] ?? $user['username'] ?? 'User'; $body = "

Password Reset Request

Hi " . htmlspecialchars($userName) . ",

We received a request to reset your password. Click the link below:

$resetLink

If you didn't request this, ignore this email. This link expires in 1 hour.

"; if (sendEmail($email, "Reset Your GoBotad Password", $body)) { $success = "A password reset link has been sent to your email."; } else { $error = "Failed to send email. Please try again later."; } } else { $error = "Database error. Please try again later."; } } // end rate-limit else } else { $displayType = $type; if ($type === 'client') $displayType = 'customer'; $error = "This email address is not registered as a " . htmlspecialchars($displayType) . "."; } } } } ?> <?php echo htmlspecialchars($seo['title']); ?>

Forgot Password?

Enter your registered email address and we'll send you a link to reset your password.

Back to Login
Need Help? Security & Account Recovery

Recovering your GoBotad account is simple and highly secure. Enter your registered email address above, and our system will instantly verify it. If a matching account is found in our database, we will email you a unique, encrypted password reset link that is valid for exactly one hour. For security reasons, the link will expire after one hour or once it has been used to set a new password, preventing unauthorized access to your account.

If you do not receive the password reset email within a few minutes, please check your spam or junk folder, or verify that you entered the correct email address associated with your GoBotad profile. Our automated mail servers deliver notifications immediately. If you continue to experience technical difficulties or are unable to access your email account, please contact our support team at gobotad@gmail.com for personalized assistance.

We recommend creating a strong, unique password that you do not use on other websites. A strong password should be at least 8 characters long and contain a mix of uppercase and lowercase letters, numbers, and special symbols. Never share your password, OTP, or reset links with anyone, including GoBotad customer care executives. Our support team will never ask you for your account credentials.