diff --git a/templates/user/settings/account.tmpl b/templates/user/settings/account.tmpl
index 290745222d..56c3df7f84 100644
--- a/templates/user/settings/account.tmpl
+++ b/templates/user/settings/account.tmpl
@@ -8,7 +8,7 @@
 		</h4>
 		<div class="ui attached segment">
 			{{if or (.SignedUser.IsLocal) (.SignedUser.IsOAuth2)}}
-			<form class="ui form" action="{{.Link}}?tp=password" method="post">
+			<form class="ui form" action="{{AppSubUrl}}/user/settings/account" method="post">
 				{{.CsrfTokenHtml}}
 				{{if .SignedUser.IsPasswordSet}}
 				<div class="required field {{if .Err_OldPassword}}error{{end}}">
@@ -49,13 +49,13 @@
 					<div class="item">
 						{{if not .IsPrimary}}
 							<div class="right floated content">
-								<button class="ui red tiny button delete-button" id="delete-email" data-url="{{$.Link}}/email/delete" data-id="{{.ID}}">
+								<button class="ui red tiny button delete-button" id="delete-email" data-url="{{AppSubUrl}}/user/settings/account/email/delete" data-id="{{.ID}}">
 									{{$.i18n.Tr "settings.delete_email"}}
 								</button>
 							</div>
 							{{if .IsActivated}}
 								<div class="right floated content">
-									<form action="{{$.Link}}/email" method="post">
+									<form action="{{AppSubUrl}}/user/settings/account/email" method="post">
 										{{$.CsrfTokenHtml}}
 										<input name="_method" type="hidden" value="PRIMARY">
 										<input name="id" type="hidden" value="{{.ID}}">
@@ -73,7 +73,7 @@
 			</div>
 		</div>
 		<div class="ui attached bottom segment">
-			<form class="ui form" action="{{.Link}}/email" method="post">
+			<form class="ui form" action="{{AppSubUrl}}/user/settings/account/email" method="post">
 				{{.CsrfTokenHtml}}
 				<div class="required field {{if .Err_Email}}error{{end}}">
 					<label for="email">{{.i18n.Tr "settings.add_new_email"}}</label>
@@ -92,7 +92,7 @@
 			<div class="ui red message">
 				<p class="text left"><i class="octicon octicon-alert"></i> {{.i18n.Tr "settings.delete_prompt" | Str2html}}</p>
 			</div>
-			<form class="ui form ignore-dirty" id="delete-form" action="{{.Link}}/delete" method="post">
+			<form class="ui form ignore-dirty" id="delete-form" action="{{AppSubUrl}}/user/settings/account/delete" method="post">
 				{{.CsrfTokenHtml}}
 				<input class="fake" type="password">
 				<div class="required field {{if .Err_Password}}error{{end}}">
diff --git a/templates/user/settings/security_accountlinks.tmpl b/templates/user/settings/security_accountlinks.tmpl
index 93cc508a54..057a0f9aff 100644
--- a/templates/user/settings/security_accountlinks.tmpl
+++ b/templates/user/settings/security_accountlinks.tmpl
@@ -10,7 +10,7 @@
 		{{range $loginSource, $provider := .AccountLinks}}
 			<div class="item">
 				<div class="right floated content">
-						<button class="ui red tiny button delete-button" id="delete-account-link" data-url="{{$.Link}}/account_link" data-id="{{$loginSource.ID}}">
+						<button class="ui red tiny button delete-button" id="delete-account-link" data-url="{{AppSubUrl}}/user/settings/security/account_link" data-id="{{$loginSource.ID}}">
 							{{$.i18n.Tr "settings.delete_key"}}
 						</button>
 				</div>
diff --git a/templates/user/settings/security_openid.tmpl b/templates/user/settings/security_openid.tmpl
index 12f4aab419..82a05f3885 100644
--- a/templates/user/settings/security_openid.tmpl
+++ b/templates/user/settings/security_openid.tmpl
@@ -9,12 +9,12 @@
 		{{range .OpenIDs}}
 			<div class="item">
 				<div class="right floated content">
-						<button class="ui red tiny button delete-button" id="delete-openid" data-url="{{$.Link}}/openid/delete" data-id="{{.ID}}">
+						<button class="ui red tiny button delete-button" id="delete-openid" data-url="{{AppSubUrl}}/user/settings/security/openid/delete" data-id="{{.ID}}">
 							{{$.i18n.Tr "settings.delete_key"}}
 						</button>
 				</div>
 					<div class="right floated content">
-						<form action="{{$.Link}}/openid/toggle_visibility" method="post">
+						<form action="{{AppSubUrl}}/user/settings/security/openid/toggle_visibility" method="post">
 						{{$.CsrfTokenHtml}}
 						<input name="id" type="hidden" value="{{.ID}}">
 						{{if .Show}}
@@ -39,7 +39,7 @@
 	</div>
 </div>
 <div class="ui attached bottom segment">
-	<form class="ui form" action="{{.Link}}/openid" method="post">
+	<form class="ui form" action="{{AppSubUrl}}/user/settings/security/openid" method="post">
 		{{.CsrfTokenHtml}}
 		<div class="required field {{if .Err_OpenID}}error{{end}}">
 			<label for="openid">{{.i18n.Tr "settings.add_new_openid"}}</label>
diff --git a/templates/user/settings/security_twofa.tmpl b/templates/user/settings/security_twofa.tmpl
index 05112a21bb..138872d317 100644
--- a/templates/user/settings/security_twofa.tmpl
+++ b/templates/user/settings/security_twofa.tmpl
@@ -5,12 +5,12 @@
 	<p>{{.i18n.Tr "settings.twofa_desc"}}</p>
 	{{if .TwofaEnrolled}}
 	<p>{{$.i18n.Tr "settings.twofa_is_enrolled" | Str2html }}</p>
-	<form class="ui form" action="{{.Link}}/two_factor/regenerate_scratch" method="post" enctype="multipart/form-data">
+	<form class="ui form" action="{{AppSubUrl}}/user/settings/security/two_factor/regenerate_scratch" method="post" enctype="multipart/form-data">
 		{{.CsrfTokenHtml}}
 		<p>{{.i18n.Tr "settings.regenerate_scratch_token_desc"}}</p>
 		<button class="ui blue button">{{$.i18n.Tr "settings.twofa_scratch_token_regenerate"}}</button>
 	</form>
-	<form class="ui form" action="{{.Link}}/two_factor/disable" method="post" enctype="multipart/form-data" id="disable-form">
+	<form class="ui form" action="{{AppSubUrl}}/user/settings/security/two_factor/disable" method="post" enctype="multipart/form-data" id="disable-form">
 		{{.CsrfTokenHtml}}
 		<p>{{.i18n.Tr "settings.twofa_disable_note"}}</p>
 		<div class="ui red button delete-button" id="disable-twofa" data-type="form" data-form="#disable-form">{{$.i18n.Tr "settings.twofa_disable"}}</div>
@@ -18,7 +18,7 @@
 	{{else}}
 	<p>{{.i18n.Tr "settings.twofa_not_enrolled"}}</p>
 	<div class="inline field">
-		<a class="ui green button" href="{{.Link}}/two_factor/enroll">{{$.i18n.Tr "settings.twofa_enroll"}}</a>
+		<a class="ui green button" href="{{AppSubUrl}}/user/settings/security/two_factor/enroll">{{$.i18n.Tr "settings.twofa_enroll"}}</a>
 	</div>
 	{{end}}
 </div>