Visitors are now required to finish setting up or resetting their password before they can access private pages in an LWR site. This feature, which achieves parity with Aura sites, is enabled by default for all LWR sites, except those sites that use custom Visualforce pages for password management. In those cases, manually enable this feature.
Where: This change applies to LWR sites accessed through Lightning Experience and Salesforce Classic in Enterprise, Performance, Unlimited, and Developer editions.
How: For LWR sites that use custom Visualforce pages for password management, go to and select Block users’ access to private pages until they set up or
reset their password. To use Metadata API to enable this feature, update
disablePvtPagesForPwdResetInLWR in the site’s .network
file.
To ensure that visitors can still access custom Visualforce password-management pages after you enable this feature, make these pages public. Alternatively, use Default pages for password management.