We've had a couple of complaints lately about how one of our sites requires the user's password be at least 12 characters long, and suggests the use of special characters and capitals to increase password strength. I've had a look around our plugins and settings and such and I do not see anything dictating password length or strength, so I'm assuming this is the default? If so, how do I reduce the minimum character count to something far more reasonable like, say, 8?
8
-
18 is not a reasonable number. Reducing those minimums has significant security impacts, at 8 characters it could take less than 6 hours to crack. Most likely significantly less with the right compute cluster ( nothing AWS couldn't provide ). 8 characters also makes a lot more simple dictionary passwords possible, which could cut down the attack time to minutes or even seconds.– Tom J Nowell ♦Commented Aug 25, 2017 at 10:59
-
1Consider mnemonics and password managers. The XKCD method of 4 silly words still generates lengthy passwords that're easy to remember, e.g. "correct-horse-staple-battery" xkcd.com/936– Tom J Nowell ♦Commented Aug 25, 2017 at 11:00
-
1Just checked, at least as admin there is no such restriction. However, you have to tick the "Confirm use of weak password" checkbox– keroCommented Aug 25, 2017 at 11:00
-
1Passwords do not have a minimum character requirement, but there is an minimum strength requirement. The strength is determined by zxcvbn. There are plugins that let you change the strength requirements however, like this one: wordpress.org/plugins/wc-password-strength-settings– Jacob PeattieCommented Aug 25, 2017 at 11:29
-
1@McOwen I find it very confusing too, it mislead user to think that "IT IS A MUST" to have 12 character long password to register an account. But actually it's just an indicator that in order to have a strong password, we need a 12 character long password.– WilliamCommented Jul 27, 2018 at 5:56
|
Show 3 more comments
1 Answer
A.) By default WordPress allows short passwords but "Confirm use of weak password" must be checked.
B.) Disable security plugins or change their settings if possible as they can and do override whatever WordPress implements by default.
C.) The latest consensus about passwords suggests the strongest passwords are extra long easy to remember phrases like: !-visited-!600-w-pennsylvan!a-avenue
-
2