Site accounts and email
Site accounts
Visitors can have accounts on your public site, separate from the people who edit it. Under Site accounts choose who can sign up (nobody, invited people, or anyone), which roles new accounts get, and whether they must confirm their email address: not at all, by a link that still lets them in, or before they can sign in.
The pages are /account/login, /account/signup, /account for the profile, and /account/forgot for a reset. Reset links last an hour and replace any earlier ones. Confirmation links last three days. Both work once.
Extensions can check a visitor's role, so you can build members-only pages and staff tools. Restyle the account pages by overriding them in your template.
A super user sets the mail server under This install > Email: server, port, STARTTLS or TLS, username, password and the From address. Every message goes through one outbox, which retries six times and erases the message text once delivered. It keeps the subject and address for 30 days.
Without a mail server, messages wait in the outbox, and a super user can open them there. That is how you follow reset links while testing. Links in emails use the site's public address, so a forged request cannot point a reset link elsewhere.