Choose how password rules apply

Password Policy Manager gives WordPress administrators controls for password requirements and credential changes. Enterprise and Premium include password strength review, expiry, resets, first-login requirements, inactive-session controls, and multisite policy management.

Set minimum and maximum password lengths along with other administrator-defined constraints. A strength meter and password score classify passwords as strong, medium, or weak. Administrators can review customers’ password strength and related password information in the administration workflow.

Manage password changes and resets

• Password expiry: Set a period after which users must make a new password.
• Next-login change: Require users to change their password the next time they log in.
• One-click reset: Invalidate current passwords and require users to generate new ones.

When a reset is used for users, their current sessions are killed, and they must set a new strong password through email.

Set role and network policies with Enterprise

The Enterprise plan lets administrators require users in selected roles to create strong passwords on their first login. It also supports logging out inactive users and destroying their sessions after a customizable period, as well as creating password policies for an entire WordPress multisite network.

Apply policies by role or visitor with Premium

Premium lets administrators set password policies for selected roles or individual users. It includes Enterprise capabilities for inactive-user logout and multisite policy management.

• Require selected users to create strong passwords on their first login.
• Require specific roles to change passwords at their next login.
• Use role-based one-click password reset and logout controls.
• Use supported custom login forms, including WooCommerce, Elementor, and Ultimate Member.

Configure and test the policy

Set password length and strength constraints, then review password scores to identify weak credentials. Require a password change or use a one-click reset when needed. Assign policies by role or user for various account groups. On a multisite installation, configure the policy for the network rather than managing each website separately.

Install Password Policy Manager in WordPress, activate the relevant edition, and configure its rules and enforcement settings. For a supported custom login form, configure the policy for that login experience. Test first-login, expiry, reset, and inactivity settings with suitable accounts before applying them broadly.