3

My users have the ability to change their password from a plugin admin screen. I want to make sure the password they create meets whatever the minimum requirements are. I'm not trying to change the password requirements. I just want to know what the default requirements are. Is there are function I can use to get the default requirements?

0

2 Answers 2

2

The minimum requirements are that it passes the zxcvbn library's strength check. I can't see a simple summary of their rules. This is registered as script 'zxcvbn-async' that you can enqueue / make a dependency of your own scripts, and then you can run the check yourself on the client-side. See password-strength-meter and user-profile.js's multiple cases for zxcvbn being not-yet-loaded.

Nowadays WordPress encourages you to use randomly generated passwords

  • new user registrations always have a randomly generated password
  • to change your password in the admin site you click 'generate password' to get a new random one; it does give you the chance to override it but will disable the 'Update profile' button on the page until your password has passed a zxcvbn check.

This is only enforced on the client-side though; there's no server-side enforcement as far as I can see. user.php does have a check_passwords action but isn't passed $errors to raise weak password errors itself; you'd have to remember the error and add it in user_profile_update_errors later. But there isn't anything like that in a default WordPress install.

1
  • To add to the above, the zxcvbn library uses a scoring model of strength. It looks for common passwords, names, popular English words, and common patterns like dates, repeats (aaa), sequences (abcd), and keyboard patterns (qwerty). zxcvbn allows many password styles so long as it detects sufficient complexity based on its algorithm. However, WP itself does not have specific requirements for pwds (see the other answer). It merely uses the zxcvbn library to determine strength. There is no required strength to create/update a user through WP alone (noting that plugins can change that).
    – butlerblog
    Jan 27 at 14:44
1

Surprisingly, for plugin development, correct answer is none

From set password documentation:

wp_set_password( string $password, int $user_id )

Updates the user’s password with a new encrypted one.

If you think about security, try going with wp_generate_password function

EDIT I have found article how to add password strength meter to wordpress which most probably describes, what you want to achieve. Take look at it

4
  • Are you saying there are no default password requirements or just no function to get them?
    – Kirkland
    Feb 8, 2020 at 20:23
  • I am saying that there are no default password requirements for plugin development (meaning for user account related operations done by plugin) Feb 8, 2020 at 20:27
  • 1
    My plugin provides a screen that allows the user to change their WP login password. The password that let's them login to WP. When they submit a new password I want to make sure that it meets the minimum WP password requirements. This is not about operations done by the plugin. I just want to know what the minimum requirements are for a WP login password and if I can get those requirements programmatically.
    – Kirkland
    Feb 10, 2020 at 2:17
  • @Kirkland see edit. I think I found a solution for you Feb 10, 2020 at 7:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.