1

Looking for to add reset password policy.

Password specifications :

12 characters in length, 1 uppercase letter, 1 lowercase letter, 1 number, and 1 special character.

I find a hooks for manage policy to change user password on the backoffice :

add_action( 'resetpass_form', function( $user ) { ?> <p class="user-wpse-pass2-wrap">
        <label for="wpse-pass2"><?php _e( 'Confirm new password' ) ?></label><br />
        <input type="password" name="wpse-pass2" id="wpse-pass2" class="input" 
               size="20" value="" autocomplete="off" />
    </p> <?php } );

add_action( 'validate_password_reset', function( $errors ) {
    if ( isset( $_POST['pass1'] ) && $_POST['pass1'] != $_POST['wpse-pass2'] )
        $errors->add( 'password_reset_mismatch', __( 'The passwords do not match.' ) ); } );


function validate_password_reset ($Password) {
    //#### Check it's greater than 12 Characters
    if (strlen($Password) < 12) {
        return "Password is too short (" . strlen($Password) . "), please use 12 characters or more.";
    }

    //#### Test password has uppercase and lowercase letters
    if (preg_match("/^(?=.*[a-z])(?=.*[A-Z]).+$/", $Password) !== 1) {
        return "Password does not contain a mix of uppercase & lowercase characters.";
    }

    //#### Test password has mix of letters and numbers
    if (preg_match("/^((?=.*[a-z])|(?=.*[A-Z]))(?=.*\d).+$/", $Password) !== 1) {
        return "Password does not contain a mix of letters and numbers.";
    }

    //#### Password looks good
    return true; }

I want to add the same policy for reset password on login page like for this site!

enter image description here

Thanks.

6
  • This sounds somewhat arbitrary, given that this policy makes it harder for humans to remember and no more difficult for humans to remember, would it not make more sense to either enforce a minimum password length, or entropy?
    – Tom J Nowell
    Commented Mar 15, 2018 at 16:43
  • It's a recommandation for security certification. This allows to have a better security for the platform. The password will be harder to find if we use different type of characters.
    – Samuel
    Commented Mar 15, 2018 at 16:54
  • 1
    What if I want a 16 character password, or pass phrases that are 20 characters and above? Both of which would be more secure but fail the policy
    – Tom J Nowell
    Commented Mar 15, 2018 at 17:49
  • For example on wordpress stackexchange we need at last 8 characters with numbers and letters it's them policy.
    – Samuel
    Commented Mar 15, 2018 at 18:02
  • I would consider this site an example of poor password security
    – Tom J Nowell
    Commented Mar 15, 2018 at 19:03

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.