We've had a couple of complaints lately about how one of our sites requires the user's password be at least 12 characters long, and suggests the use of special characters and capitals to increase password strength. I've had a look around our plugins and settings and such and I do not see anything dictating password length or strength, so I'm assuming this is the default? If so, how do I reduce the minimum character count to something far more reasonable like, say, 8?

  • 1
    8 is not a reasonable number. Reducing those minimums has significant security impacts, at 8 characters it could take less than 6 hours to crack. Most likely significantly less with the right compute cluster ( nothing AWS couldn't provide ). 8 characters also makes a lot more simple dictionary passwords possible, which could cut down the attack time to minutes or even seconds. – Tom J Nowell Aug 25 '17 at 10:59
  • 1
    Consider mnemonics and password managers. The XKCD method of 4 silly words still generates lengthy passwords that're easy to remember, e.g. "correct-horse-staple-battery" xkcd.com/936 – Tom J Nowell Aug 25 '17 at 11:00
  • 1
    Just checked, at least as admin there is no such restriction. However, you have to tick the "Confirm use of weak password" checkbox – kero Aug 25 '17 at 11:00
  • 1
    Passwords do not have a minimum character requirement, but there is an minimum strength requirement. The strength is determined by zxcvbn. There are plugins that let you change the strength requirements however, like this one: wordpress.org/plugins/wc-password-strength-settings – Jacob Peattie Aug 25 '17 at 11:29
  • 1
    @McOwen I find it very confusing too, it mislead user to think that "IT IS A MUST" to have 12 character long password to register an account. But actually it's just an indicator that in order to have a strong password, we need a 12 character long password. – William Jul 27 '18 at 5:56

A.) By default WordPress allows short passwords but "Confirm use of weak password" must be checked.

B.) Disable security plugins or change their settings if possible as they can and do override whatever WordPress implements by default.

C.) The latest consensus about passwords suggests the strongest passwords are extra long easy to remember phrases like: !-visited-!600-w-pennsylvan!a-avenue

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.