Weak Passwords Put Your Site at Risk, You Need a Password Policy for All WordPress User Accounts.

Attackers can compromise WordPress sites through weak credentials and basic access points. If one of your sites’ users sets a weak password, reuses an old one, or picks something that was already leaked in a breach years ago, that is all it takes. This is why you need a global password policy for all WordPress users on your site. In this guide, we will walk through every part of a solid password policy for all WordPress users and how to set it up.

What a Password Policy for All WordPress Users Actually Covers

A lot of site owners think a password policy just means “make people use a longer password.” That is only one small piece of it. A real password policy covers the entire life of a password, from the day it is created to the day it needs to be replaced. That includes:

• What counts as a valid password (length, characters, complexity)
• Whether users can reuse old passwords
• Whether passwords expire, and what happens after they do
• How users get notified about changes
• What happens the first time a new employee or member logs in
• Whether users can reset their own password, or need help from you
• Whether the password has already shown up in a public data breach

Everything covered below comes from Ultimate Security. It gives you all of these password requirement rules for free, on one settings page, so you are not juggling three different plugins just to cover the basics. Before you follow any of the steps in this guide, make sure Ultimate Security is installed and active on your site. The rest of this guide goes through each piece one at a time.

How to Set Up a Global Password Policy for All WordPress Users

Here is how to actually put a password policy for all WordPress users completely free.

• Open the Password Requirements settings. This is where every rule covered in this guide lives, all in one place.
• Turn on “Enable password policies.” This is the master switch. Nothing below it works until this is on.
• Pick a preset to start with. Basic, Strong, or Enterprise, based on how much risk your site actually carries.
• Adjust minimum length and character rules if needed. The preset gives you a starting point, but feel free to raise the bar for admin accounts specifically.
• Set password history. A value of 3 to 5 is a solid middle ground for most sites.
• Decide on expiration. If your site needs it, set the expiration period along with warning days and a grace period so it does not feel abrupt.
• Turn on email notifications. This keeps users informed and cuts down on confused support requests.
• Enable first login reset. This makes sure new accounts start with a password only the actual user knows.
• Decide on self service reset. If you disable it, fill in a custom message or reset URL so users know what to do instead.
• Turn on the compromised password check. This closes the gap that length and complexity rules alone cannot cover.
• Save your changes. Test it yourself by trying to set a weak or previously leaked password, just to confirm the rules are actually working.

That is the whole process. None of these steps take more than a minute or two.

Core Password Requirements Every Site Should Set

Before touching anything else, you need to decide what actually makes a password strong. This is the foundation everything else builds on, and getting it right matters more than any other single setting here.

Minimum Password Length

Length matters more than almost anything else. Every extra character multiplies how many combinations an attacker has to guess through, and that math adds up fast.

There is no single number that works for every site. The right length depends on how the site is used and how much risk it carries, so it is worth setting a minimum that fits your own situation rather than copying a number from somewhere else. Ultimate Security lets you set this to whatever number fits your preference.

Requiring Uppercase, Lowercase, Numbers, and Symbols

Beyond length, you can require a mix of:

• Uppercase and lowercase letters
• At least one number
• At least one special character

Each rule closes off another lazy password pattern, like an all lowercase word or a string of plain digits. Combined, they push users toward something that is actually hard to guess.

Excluding Certain Special Characters

Sometimes a special character causes real problems elsewhere on your site, like breaking a login form, an API connection, or a database field.

Stopping Password Reuse With Password History

Here is a scenario that happens more than people admit. A user gets forced to change their password, so they change it, then immediately change it right back to the old one. Password history is what stops that loop.

By default, this is set to 1, so a user cannot reuse their most recent password. Bump it up to 5, and they cannot reuse any of their last five. This setting works especially well alongside expiration, since it actually forces people to think of something new instead of bouncing between two familiar passwords.

Handling Password Expiration Without Frustrating Everyone

Expiration is one of the more debated parts of a password policy, mainly because it can go wrong in both directions. Set it too loosely and it does nothing. Set it too aggressively and users start writing passwords on sticky notes just to keep up.

The plugin gives you three settings that work together to get this balance right.

Setting an Expiration Period That Makes Sense

Expiration forces users to set a new password after a set stretch of time. Set it to 0, and passwords never expire. Set it to 3 and pick months, and every user has to update their password every three months.

Whether you actually need this depends heavily on your site. Compliance heavy sites often require it. A small business site with two admin accounts probably does not need to bother, and forcing it there just annoys people for little gain.

Using Warning Days to Avoid Surprises

If you do turn on expiration, warning days is what stops it from feeling like an ambush. Set this to 7, for example, and users get a heads up a week before their password stops working, giving them time to change it on their own schedule instead of getting locked out mid task.

What the Grace Period Actually Does

The grace period gives users a short window to still log in after their password has technically expired, usually forcing them to pick a new one right away during that window. Once the grace period ends, they are locked out until an admin steps in. This one setting alone prevents the harsh situation of someone getting locked out the second the clock hits zero.

Keeping Users in the Loop With Email Notifications

None of this works well if people are caught off guard. Turning on email notifications means WordPress automatically tells users about upcoming expirations or required changes, so you are not fielding confused support messages asking why someone suddenly cannot log in. It is a small setting, but it saves a surprising amount of back and forth.

Controlling How Users Reset Their Passwords

Password resets are usually the most overlooked part of a password policy and also one of the most abused.

Attackers who cannot guess a password directly will sometimes try to exploit the reset flow instead, so it is worth deciding upfront how much control you want over that process.

Forcing a Password Change on First Login

When you create a new account for someone, you usually set a temporary password yourself. First login reset closes an obvious gap here. It forces that person to set their own password the very first time they log in, so you are not the only one who ever knew it.

This matters more than people expect, especially on sites where staff or client accounts get created in bulk. It is a tiny setting with a real security payoff.

When Disabling Self Service Reset Makes Sense

By default, WordPress lets anyone click “Lost your password?” and reset it through email. For most sites, that is completely fine and honestly more convenient. For high-security sites, this same feature can become a target, since attackers sometimes try to abuse password reset flows to take over accounts.

Disabling self-service reset removes that option entirely, so users have to go through you or your team instead.

Writing a Custom Reset Message

If you turn off self-service reset, people still need to know what to do next. Write a custom message that replaces the default reset link, so you can tell users exactly who to contact and how. If you already have your own request form or support page, you can send users there directly with a custom reset URL instead of relying on the default WordPress flow.

Blocking Passwords That Have Already Leaked

Everything covered so far controls how a password is built. None of it can tell you whether that same password is already sitting in a public database somewhere, from a breach on a completely different website. This is the gap that trips up even a strict, well built password policy.

How the Compromised Password Check Works

Here is something a lot of site owners miss. A password can be long, complex, and follow every rule on this page, and still be a risk if it already leaked somewhere else online.

Ultimate Security checks passwords in real time against the Have I Been Pwned database, one of the largest public collections of leaked credentials, and blocks any match during registration, profile updates, or password resets.

Forcing Existing Users to Reset Their Passwords

Every rule covered so far only applies going forward. If your site already has users with passwords set months or years before you turned on this policy, those old passwords keep working exactly as they are. Nothing forces them to change until they update their password on their own, or until an expiration date kicks in, if you have one set.

This feature is especially useful in situations like:

• A site that has been live for a while and never had a password policy until now
• Onboarding a new client site where old staff or contributor accounts already exist
• After a suspected breach, when you want every non-admin password refreshed right away
• Cleaning up a membership or WooCommerce site with many dormant accounts sitting on old passwords
• Right after you finish setting up or updating your password policy, so it applies immediately instead of waiting on natural password changes

This is worth using right after you finish configuring your password policy, not months later. There is one requirement to keep in mind though: password policies must be enabled and saved first. The reset button enforces whatever rules are already active, so if nothing is set up yet, forcing a reset does not accomplish much.

Pair Strong Password Rules With Two Factor Authentication

A strong password policy is a big step, but it is not the whole picture. Even a long, complex, breach checked password can still be stolen through phishing, malware on a user’s device, or a leak on some other unrelated site. Once an attacker has that password in hand, a password policy alone will not stop them from logging in.

This is where two factor authentication comes in. It adds a second step to the login process, usually a code from an app or a text message, so a password by itself is no longer enough to get into an account. Pairing a solid password policy with two factor authentication covers both sides of the problem, one making passwords hard to guess or steal in the first place and the other making a stolen password far less useful on its own.

If you have not set this up yet, it is worth doing right after you finish your password policy, while login security is already fresh on your mind.

Frequently Asked Questions

Conclusion

A password policy for all WordPress users only works if it actually fits how your site gets used. A one person blog does not need the strictest rules available, and forcing that kind of strictness on a low risk site just creates friction for no real benefit.

Start with the requirements that match your site, then fine tune history, expiration, and breach checking based on what your site actually needs. Ultimate Security keeps every one of these controls in one place, so you get a real password policy for all WordPress users without stitching together several plugins to cover the gaps.