Password policies for WordPress
Set real password rules (length, complexity, history and expiry) and check new passwords against the Have I Been Pwned breach database without the password ever leaving your server.
What it does
WordPress will happily accept "password1" from an administrator. This module enforces the rules you choose everywhere passwords are set: registration, resets, profile updates, and the WooCommerce equivalents of all three.
How it works
Rules cover minimum length, mixed case, numbers and special characters, a blocklist of known-weak words, and a ban on passwords containing the username. Password history keeps previous hashes so old passwords cannot come back, and optional expiry forces a change after the interval you set, with an email warning first and a grace window so nobody is stranded.
The breach check is the standout: new passwords are checked against Have I Been Pwned using k-anonymity (a five-character hash prefix is sent, never the password), with results cached for 30 days. If the API is unreachable, the check fails open rather than blocking logins.
- Length, case, number and special-character rules with presets
- Known-weak-word and username-in-password blocking
- Have I Been Pwned breach checking (privacy-preserving)
- Password history and reuse blocking
- Expiry with warning emails and a grace period
- Force a password change on first login
- Optionally disable self-service resets entirely
- Applies to WordPress and WooCommerce forms
Documentation
Password policy questions
Does the breach check send passwords to a third party?
No. It uses Have I Been Pwned's k-anonymity API: only the first five characters of the password's SHA-1 hash are transmitted, and matching happens on your server.
What if the breach API is down?
The check fails open (users can still set passwords) because availability should never depend on a third-party API. Results are also cached for 30 days.
Can I force everyone to change their password?
Password expiry handles rotation on a schedule, and a first-login change requirement covers newly created accounts.
Related features
Secure your site today
Install the free plugin from WordPress.org and set up real protection with the guided setup wizard. Upgrade to Pro whenever you need more.