Skip to content

Passwords

Password rules

Every planAbout Passwords

Sets the rules every new password must meet: a minimum length, the kinds of characters it needs, no personal details, and never a password already leaked in a data breach.

What it does

Whenever someone sets a password, on their profile, when signing up or through a reset link, Stack Guard checks it against your rules. If it falls short, they see exactly what is missing and choose another.

Minimum length: the fewest characters allowed. Length is the single biggest factor in a strong password.

Character rules: require an uppercase letter, a lowercase letter, a number and a symbol or space. Each can be switched on or off.

Passphrase length: a long password, such as four random words, may skip the character rules. Set the length that counts as long enough.

Block personal information: refuses passwords that contain the username, display name, first or last name, or the first part of the email address.

Block passwords found in data breaches: refuses any password that appears in the public list of leaked passwords, even if it looks strong.

Why it matters

Attackers do not guess letter by letter; they try lists of real passwords that leaked from other sites. A password on such a list falls in seconds, however clever it looks. Length and the breach check together defeat those lists.

Set it up

  1. Go to the Passwords tab, section Password policy, and switch on Password Requirements.
  2. Choose a Minimum length. 12 is a good balance; 14 or more is better for administrators.
  3. Pick the Character rules you want. If you prefer long passphrases, set a Passphrase length such as 20.
  4. Switch on Block personal information and Block passwords found in data breaches.
  5. Click Save Changes. The rules apply the next time each person sets a password.

Good to know

Existing passwords are not checked until they are changed. To make everyone choose a new one now, use Forced password resets.

Choosing No Requirements for length turns off the length and character rules, but the personal information and breach checks still apply if they are on.

If the breach list cannot be reached, the password is allowed rather than blocking the person.

The Password Generator in the side panel of the Passwords tab makes a random password that meets your rules.

Blocking reuse of recent passwords is on the roadmap.

Which plan includes it

Password rules, including character rules, passphrase length and the breach check, are in every plan. Blocking personal information in passwords is part of Pro.

How it works, for developers
  • Checks run on user_profile_update_errors, registration_errors and validate_password_reset, all through SMG_Password::missing_requirements(). Length counts characters, not bytes, and the character rules understand letters in any language.
  • Breach check: the password is hashed with SHA-1 and only the first 5 characters of the hash are sent to api.pwnedpasswords.com/range/ (with padding). The password itself never leaves your server. The request times out after 5 seconds.
  • Personal information pieces shorter than 3 characters are ignored, so short names do not block every password.
  • Stack Guard always records when a password changed and how strong it was (user meta smg_password_changed, smg_password_strength), which the Access tab and the expiry rules use.
  • Settings: smg_password_requirements_enabled, smg_password_min_length, smg_password_require_upper, _lower, _number, _symbol, smg_password_passphrase_length, smg_password_block_personal, smg_refuse_compromised.

Quick answers about password rules

What does Password rules do in Stack Guard?

Whenever someone sets a password, on their profile, when signing up or through a reset link, Stack Guard checks it against your rules. If it falls short, they see exactly what is missing and choose another. Minimum length: the fewest characters allowed. Length is the single biggest factor in a strong password. Character rules: require an uppercase letter, a lowercase letter, a number and a symbol or space. Each can be switched on or off. Passphrase length: a long password, such as four random words, may skip the character rules. Set the length that counts as long enough. Block personal information: refuses passwords that contain the username, display name, first or last name, or the first part of the email address. Block passwords found in data breaches: refuses any password that appears in the public list of leaked passwords, even if it looks strong.

Why use password rules on a WordPress site?

Attackers do not guess letter by letter; they try lists of real passwords that leaked from other sites. A password on such a list falls in seconds, however clever it looks. Length and the breach check together defeat those lists.

How do I set up password rules?

1. Go to the Passwords tab, section Password policy, and switch on Password Requirements. 2. Choose a Minimum length. 12 is a good balance; 14 or more is better for administrators. 3. Pick the Character rules you want. If you prefer long passphrases, set a Passphrase length such as 20. 4. Switch on Block personal information and Block passwords found in data breaches. 5. Click Save Changes. The rules apply the next time each person sets a password.

Which Stack Guard plan includes password rules?

Password rules, including character rules, passphrase length and the breach check, are in every plan. Blocking personal information in passwords is part of Pro.

More in Passwords

Not running Stack Guard yet? It is free.

Download Free