0

Since i'm doing Wordpress hardening for a project and ran into some questions that I haven't found a good answer online. If anyone has had any experience with this kind of stuff or have any know-how about this even a plugin recommendation it would be really appreciated.

  1. When admin is resetting all users password are the users getting notified about the password reset? I read that with some "Emergency password reset" plugin it is available, but is it a built in feature in Wordpress or no.

  2. When user changes his/her password, the user shouldn't be able to use the last password again. Is there a builtin functionality in Wordpress for this or a external plugin?

  3. Is it possible to force users for certain password patterns. For ex. not allowing users to use more than 2 same letter straight in a row and force in symbols, number and lower and uppercase letters.

  4. When Admin adds a new user the new user gets and email for creating his/her self a password. Is it possible to make the password generation link to expire after 24/48h?

It would be best, if there is no default functionality built into Wordpress, to get the hands on a plugin that would answer all of the 4 problematic points.

Improve this question
1
  • There is no such built-in functionality, you have to develop it yourself.
    – Max Yudin
    Commented Jun 19, 2018 at 16:04

1 Answer 1

Reset to default
2

When admin is resetting all users password are the users getting notified about the password reset? I read that with some "Emergency password reset" plugin it is available, but is it a built in feature in Wordpress or no.

WordPress doesn't have an option to reset all users passwords, so it would depend on the plugin you use.

When user changes his/her password, the user shouldn't be able to use the last password again. Is there a builtin functionality in Wordpress for this or a external plugin?

Why would they even be able to? No of course users can't use previous passwords. User's can't log in with old passwords, but there's nothing in WordPress core preventing users from re-using old passwords.

Is it possible to force users for certain password patterns. For ex. not allowing users to use more than 2 same letter straight in a row and force in symbols, number and lower and uppercase letters.

Not out of the box, but a plugin might be able to do this. I haven't seen any though. All I've seen are plugins that let you require a minimum strength as already measured by WordPress, but not specific patterns or minimum types of characters etc.

When Admin adds a new user the new user gets and email for creating his/her self a password. Is it possible to make the password generation link to expire after 24/48h?

It already expires after 24 hours. This can be changed with the password_reset_expiration filter.

Improve this answer
4
  • "Why would they even be able to? No of course users can't use previous passwords." you sure?
    – Mark Kaplun
    Commented Jun 19, 2018 at 9:18
  • Bah, I just realised he meant could they re-use passwords, I interpreted the question as 'could they log in with old passwords', which, duh.
    – Jacob Peattie
    Commented Jun 19, 2018 at 10:13
  • yes, now I can see how you got there
    – Mark Kaplun
    Commented Jun 19, 2018 at 10:30
  • As of reading this article from WPMU Dev there is a point #4 "Reject old password" and it seems to be possible, but there are no hints about it if it is from core setup or from some kind of plugin. With the 3rd question, I think that removing the option from the user to use "Confirm the use of a weak password" option could already be beneficial enough.
    – Peeter Sikk
    Commented Jun 19, 2018 at 11:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.