Looking for to add reset password policy.

Password specifications :

12 characters in length, 1 uppercase letter, 1 lowercase letter, 1 number, and 1 special character.

I find a hooks for manage policy to change user password on the backoffice :

add_action( 'resetpass_form', function( $user ) { ?> <p class="user-wpse-pass2-wrap">
        <label for="wpse-pass2"><?php _e( 'Confirm new password' ) ?></label><br />
        <input type="password" name="wpse-pass2" id="wpse-pass2" class="input" 
               size="20" value="" autocomplete="off" />
    </p> <?php } );

add_action( 'validate_password_reset', function( $errors ) {
    if ( isset( $_POST['pass1'] ) && $_POST['pass1'] != $_POST['wpse-pass2'] )
        $errors->add( 'password_reset_mismatch', __( 'The passwords do not match.' ) ); } );

function validate_password_reset ($Password) {
    //#### Check it's greater than 12 Characters
    if (strlen($Password) < 12) {
        return "Password is too short (" . strlen($Password) . "), please use 12 characters or more.";

    //#### Test password has uppercase and lowercase letters
    if (preg_match("/^(?=.*[a-z])(?=.*[A-Z]).+$/", $Password) !== 1) {
        return "Password does not contain a mix of uppercase & lowercase characters.";

    //#### Test password has mix of letters and numbers
    if (preg_match("/^((?=.*[a-z])|(?=.*[A-Z]))(?=.*\d).+$/", $Password) !== 1) {
        return "Password does not contain a mix of letters and numbers.";

    //#### Password looks good
    return true; }

I want to add the same policy for reset password on login page like for this site!

enter image description here


  • This sounds somewhat arbitrary, given that this policy makes it harder for humans to remember and no more difficult for humans to remember, would it not make more sense to either enforce a minimum password length, or entropy? – Tom J Nowell Mar 15 '18 at 16:43
  • It's a recommandation for security certification. This allows to have a better security for the platform. The password will be harder to find if we use different type of characters. – sampaii Mar 15 '18 at 16:54
  • 1
    What if I want a 16 character password, or pass phrases that are 20 characters and above? Both of which would be more secure but fail the policy – Tom J Nowell Mar 15 '18 at 17:49
  • For example on wordpress stackexchange we need at last 8 characters with numbers and letters it's them policy. – sampaii Mar 15 '18 at 18:02
  • I would consider this site an example of poor password security – Tom J Nowell Mar 15 '18 at 19:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.