How do I disable the password recovery link?
You can use hook_menu_local_tasks_alter().

E.g.

/**
 * Implements hook_menu_local_tasks_alter().
 */
function MY_MODULE_menu_local_tasks_alter(&amp;$data, $route_name) {
  if($route_name == 'user.login') {
    $data['tabs'][0]['user.pass']['#access'] = FALSE;
  }
}


Note: Make sure to replace MY_MODULE with the actual name of your module.