Actually there are 2 things that are going on.
1. After more testing there is a bug where the filters in the switch code are being applied even though the condition says only apply the filters if Login Security is turned On. So even if Login Security is turned Off then the password reset link is not being displayed.
2. A new independent password reset link option will be added in the next version of BPS that will allow someone to independently enable or disable the password reset link from displaying on the Login page whether Login Security is On or Off.
To fix the bug issue that is occuring now with the password reset link you can edit the /bulletproof-security/includes/login-security.php file at code lines: 596 to 670 and add the code below that is highlighted in yellow. You are adding an additional condition that if Login Security is NOT Off then proceed to process the switch code. If Login Security is Off then the script will halt and not process the switch code:
if ( $BPSoptions['bps_login_security_OnOff'] != 'Off' ) { switch ( $BPSoptions['bps_login_security_OnOff'] == 'On' ) { case $BPSoptions['bps_login_security_pw_reset'] == 'disableFrontend': if ( !is_admin() ) { function bpspro_disable_password_reset() { return false; } add_filter( 'allow_password_reset', 'bpspro_disable_password_reset' ); function bpspro_show_password_fields() { return false; } add_filter( 'show_password_fields', 'bpspro_show_password_fields' ); function bpspro_remove_pw_text($text) { return str_replace( array('Lost your password?', 'Lost your password'), '', trim($text, '?') ); } add_filter( 'gettext', 'bpspro_remove_pw_text' ); // Replace invalidcombo error - valid user account / invalid user account same exact result function bpspro_login_error_invalidcombo($text) { return str_replace( 'ERROR: Invalid username or e-mail.', 'Password reset is not allowed for this user', $text ); } add_filter ( 'login_errors', 'bpspro_login_error_invalidcombo'); // Replace invalid_email error - valid email / invalid email same exact result function bpspro_login_error_invalid_email($text) { return str_replace( 'ERROR: There is no user registered with that email address.', 'Password reset is not allowed for this user', $text ); } add_filter ( 'login_errors', 'bpspro_login_error_invalid_email'); // Removes WP Shake It so that no indication is given of good/bad value/entry function bpspro_remove_shake() { remove_action( 'login_head', 'wp_shake_js', 12 ); } add_filter ( 'shake_error_codes', 'bpspro_remove_shake'); } break; case $BPSoptions['bps_login_security_pw_reset'] == 'disable': function bpspro_disable_password_reset() { return false; } add_filter( 'allow_password_reset', 'bpspro_disable_password_reset' ); function bpspro_show_password_fields() { return false; } add_filter( 'show_password_fields', 'bpspro_show_password_fields' ); function bpspro_remove_pw_text($text) { return str_replace( array('Lost your password?', 'Lost your password'), '', trim($text, '?') ); } add_filter( 'gettext', 'bpspro_remove_pw_text' ); // Replace invalidcombo error - valid user account / invalid user account same exact result function bpspro_login_error_invalidcombo($text) { return str_replace( 'ERROR: Invalid username or e-mail.', 'Password reset is not allowed for this user', $text ); } add_filter ( 'login_errors', 'bpspro_login_error_invalidcombo'); // Replace invalid_email error - valid email / invalid email same exact result function bpspro_login_error_invalid_email($text) { return str_replace( 'ERROR: There is no user registered with that email address.', 'Password reset is not allowed for this user', $text ); } add_filter ( 'login_errors', 'bpspro_login_error_invalid_email'); // Removes WP Shake It so that no indication is given of good/bad value/entry function bpspro_remove_shake() { remove_action( 'login_head', 'wp_shake_js', 12 ); } add_filter ( 'shake_error_codes', 'bpspro_remove_shake'); break; } }