07. Best Practices

Recommendations that follow from how the modules behave. Each is a suggestion, not a requirement. Adapt to your site.

Keep profile pages behind a login

All three modules act on the logged-in user, so their pages have no purpose for guests. Link them only from logged-in menus, and restrict access with your membership or theme tooling so guests are redirected to a login page rather than seeing a non-functional form.

Always pair email and password fields with Current password

Any form that can change an email address or password is an account-takeover surface. With the Current password field present, the Profile Edit Form refuses to save unless the user re-confirms their password. Include it on every form that touches account credentials.

Set a minimum password strength

When offering Change Password, enable the strength indicator with at least a Medium minimum. Users take the path of least resistance; the form enforcing a floor is more reliable than asking nicely.

Structure long forms with Title fields

A form with ten unstructured inputs feels like a tax return. Break it into sections ("Account", "About you", "Social profiles") with Title fields, and use the fieldset wrap option to group each section visually.

Make account deletion deliberate

Place the Profile Delete Form away from everyday actions, at the bottom of the account page or on a separate "Danger zone" page. Write a confirmation message that states the consequence plainly, and set the post-deletion behaviour to redirect to a public page.

Test flows with a disposable account

Password changes, avatar uploads, and account deletion all change real account state. Keep a throwaway test user and run each flow end to end after building the page, especially deletion, which cannot be undone.