0

How can I force a specific password for a specific user & not let that user change their password? I have a client that thinks that even if I force strong passwords via this plugin: https://wordpress.org/plugins/force-strong-passwords/ their users will use short & easy passwords. Thus, they want to set random 14 character passwords for every user & not let them change said passwords. Does anyone know how to do this?

  • What role will the users have? I'm guessing they will be below Admin. – Jason Murray Mar 1 '15 at 1:13
  • Yes. I can create a role for them via User Role Editor. I'm thinking they'll only be able to edit pages. Ideally if there was a way; they'd only be able to edit specific pages. – drewrowalnd Mar 1 '15 at 1:14
  • are you using SSL (https) ? – birgire Mar 1 '15 at 1:23
1

You can use this code in your functions.php to restrict users below admin level from changing their passwords:

if ( is_admin() ) {
  add_action( 'init', 'disable_password_fields', 10 );
}

function disable_password_fields() {
  if ( ! current_user_can( 'activate_plugins' ) ) {
    $show_password_fields = add_filter( 'show_password_fields', '__return_false' );
  }
}

The admin should probably register each user manually if possible and select a strong password for them.

Edit - Changed user level check. Syntax.

1

This is a very vast question so excuse me for not adding code. I do have a map for you.

For sensible reasons, WordPress doesn't have a hook or filter that can help modify user passwords before they are saved in the database. The solution proposed by @jason-murray will hide the password fields in one location — on the user profile page.

However, users can update passwords using Forgot password feature. If you hide/disable it, you'd disable your users. Instead, you could just hook into the retrieve_password_message filter.

This sends an email to the user with an activation key and all. You can generate a password using wp_hash_password and wp_generate_password, sending it in the email and updating in the database. (Try finding out the rough statistics of the number of people and the frequency at which they forget and reset passwords.)

Also, there's no point setting up passwords manually for users, especially if you have a large number of users. When users register, you could hijack the pluggable wp_new_user_notification and generate a strong password, replace the default password generated by WordPress, and send a modified email to the user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.