I'm looking for a way to add policy about POST password.

Password specifications :

12 characters in length, 1 uppercase letter, 1 lowercase letter, 1 number, and 1 special character.

Is there a hook to add on function.php to do it?

This question is about password protected posts and not USER password.

  • Not really, my question is about POST password not USER password
    – Samuel
    Mar 14, 2018 at 17:32
  • what is "post password"? do you mean password protected posts? Mar 14, 2018 at 17:40
  • I think it is the password protection for the posts, isn't it?
    – cybmeta
    Mar 14, 2018 at 17:42
  • Yes password protected posts!
    – Samuel
    Mar 14, 2018 at 17:43

1 Answer 1


I've had a look at Wordpress' core code and couldn't find anything really useful to add a filter on the post password.

You could use the filter wp_insert_post_empty_content, it is used to check whether the required fields of the post are set or not (e.g.: title).

Here is an example on how it could be used:

function myfunc_password_policy( $maybe_empty, $postarr ) {
    $result = $maybe_empty;

    // is the value of the field $postarr['post_password'] complicated enough?
    // ...

    return $result;
add_filter( 'wp_insert_post_empty_content', 'myfunc_password_policy', 9999, 2);

The problem is that there will be no relevant error message displayed in the admin if the password is refused.

Another way might be to use Javascript to hook the click event on the publish/update button and send an ajax request with the value of the password field:

function myfunc_check_password_policy(){
    global $post;

    if('post' === $post->post_type){
        echo "
                //Click handler - you might have to bind this click event another way
                $('input#publish, input#save-post').on('click', function(){
                    var password_value = $('#post_password').val();
                    var ajax_url = '" . admin_url( 'admin-ajax.php' ) . "';

                    // send an ajax request to check if the password
                            // ...
add_action('admin_head-post.php', 'myfunc_check_password_policy');
add_action('admin_head-post-new.php', 'myfunc_check_password_policy');

The code samples haven't been tested and obviously need some improvement but you should get the idea.

These are the possibilities I could think of to solve your problem. Good luck :)

  • not sure why do you want to send the AJAX request to the server, why not to just check the field client side. As for handling errors, you can always set a cookie to indicate an error Mar 16, 2018 at 8:22
  • Because I assumed the password policy would be implemented in PHP. If it can be done on the client side, then sure, no need for an ajax request.
    – Mike
    Mar 16, 2018 at 9:18
  • it should be done both sides. It is faster to have a response from avalidating JS code than wait for the at least 1 second delay required for ajax requests on most site (and that is probably optimistic estimate). In any case the ajax is not enough unless you are also blocking the submit while it is going on. Mar 16, 2018 at 9:42
  • I agree but it should be noted that the javascript solution will not work when creating a post programmatically.
    – Mike
    Mar 16, 2018 at 11:10
  • yeh, not sure this is what the OP looking for, but you have a point Mar 16, 2018 at 13:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.