1

I'm looking for a way to force using strong password when we create reset and change users password on WordPress backoffice.

Password complexity must be at least 12 characters in length, and have at least one uppercase letter, one lowercase letter, one number, and one special character.

Passwords of administrator role must be changed every 45 days at a minimum. other user's passwords must be changed every 90 days at a minimum.

Password history rules must be implemented to prevent reuse.

Thanks.

UPDATE :

About storing password to prevent reuse. There is a plugin:

https://wordpress.org/plugins/prevent-password-reuse/

For password policy I found this plugin:

https://github.com/wp-plugins/wp-password-policy-manager

But it's out to date. so I still looking for a hook to integrate on functions.php for password policy.

closed as too broad by Dave Romsey, Mark Kaplun, Nathan Johnson, Christine Cooper, EAMann Mar 3 '18 at 0:06

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • It might be easier to use a single-signon, so that users use a different login (like Google or LDAP) where it's easier to control these settings. – WebElaine Feb 28 '18 at 21:57
  • it is not recommended to use other login (google or LDAP) systems in my case. – sampaii Feb 28 '18 at 23:10
  • Password history rules imply that you will need to save previous passwords. There are security risks in that; you don't want to store user/pass credentials in plain text in any database. So good encryption of that info will be important from a security standpoint. – Rick Hellewell Mar 1 '18 at 3:50
  • 1
    right now it reads like a request for someone to develop something for you and not an actual question.. Break it down to smaller pieces and/or ask about your code or specific things you have no idea how to approch. – Mark Kaplun Mar 1 '18 at 4:21
  • pretty sure wp has it's own hash password function then you could compare that to column in db (maybe) but what are you going to do, let the user know someone else is already using that password? a plugin may help ensure secure pws, there's probably many of them. – Joel M Mar 1 '18 at 18:43
0

You might want to start here https://codex.wordpress.org/Customizing_the_Login_Form which discusses customizing the login form, and has info on the code file used therein.

You will need to 'hook' into the login form using available hooks (also detailed at the above link).

Also, my comment above: "Password history rules imply that you will need to save previous passwords. There are security risks in that; you don't want to store user/pass credentials in plain text in any database. So good encryption of that info (in a secure database) will be important from a security standpoint."

  • "Password history rules imply that you will need to save previous passwords" that is obviously wrong, unless you mean to claim that a large parentage of software in the worlds is not storing passwords securely. – Mark Kaplun Mar 1 '18 at 4:22
  • No, Mark Kaplun, that is not what I am implying. I am suggesting that if the OP is going to implement password history, then that implementation should include strong encryption on the storage of user credentials. There is no suggestion that 'a large percentage..' is doing it wrong. Only the suggestion that strong encryption of credentials would be a recommended part of an implementation of password history. Once again, you downvote with assumptions that are not the case. – Rick Hellewell Mar 1 '18 at 18:02
  • sorry, misread it, but seriously man, this is at best half an answer to the question. Full answer should also include the expiration windows and storing previous passwords etc, which is much more than just UI modifications to the login form (which should be extensive by themselves). This is a very broad question that can not have any good answer in the context of how SE is working, and it is pointless to give answer that are not going to be useful for the OP just to be nice. – Mark Kaplun Mar 1 '18 at 18:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.