Safety Passwords

Safety Passwords helps protect WordPress accounts by checking new passwords. Each password must meet the minimum length set by the site administrator and contain an uppercase letter, a lowercase letter, a number, and a special character. Users cannot reuse a password already in their history.

The administrator can also require a password change after a chosen number of days. Users see a countdown on their profile and a reminder in the admin bar during the last seven days. If the password expires, the plugin asks them to change it or use the password recovery form. Set the reset interval to 0 to turn off periodic resets and reminders.

Installing Safety Passwords as a must-use (MU) plugin is recommended. It loads automatically, and WordPress does not show a Plugins-screen control to deactivate it. A filesystem administrator can still remove the loader. See Installation below.

On WordPress multisite, network administrators manage one set of settings for the current network. Install it as MU or network activate it; activation on an individual site is not supported. WordPress shares an account’s password across networks, so a password reset on one network affects that account everywhere. See the multisite FAQ for which accounts each network checks.

The plugin can also record events with the Stream plugin.

Developers and contributors can find setup instructions on GitHub.

Override settings with PHP constants

PHP constants override saved settings; the settings page shows their effective values:

• SAFETY_PASSWORDS_MIN_LEN: integer or whole-number string for minimum length; the settings field accepts 1-24.
• SAFETY_PASSWORDS_RESET_INTERVAL: integer or whole-number string for days between required resets; the settings field accepts 0-999, and 0 disables periodic resets and reminders.
• SAFETY_PASSWORDS_RP_ON_REGISTRATION: true, 'true', 1, or '1' enables a reset after registration; false, 'false', 0, or '0' disables it.

WordPress wp_validate_boolean() interprets the registration constant; other strings such as 'off' or 'no' evaluate to true. The numeric constants accept whole-number strings without changing the settings ranges; decimal strings are not converted to integers.