Checks user e-mails and optionally passwords against breach lists from haveibeenpwned.com on signup.

Dan D

**Note: This plugin sends e-mail address (and optionally SHA1 hashed passwords) to an external API, at https://haveibeenpwned.com **
This plugin is meant to provide a service to your site members by doing the following:
<ul>
<li>On user registration, check the haveibeenpwned API to see if their e-mail has been in any known breaches</li>
<li>Stores (in user_meta) any breaches found, and if the user has been notified (by your site)</li>
<li>If welcome e-mails are enabled, adds a section sharing information about the breaches, and the suggestion to use a strong password with a link to help. If not, it also lets them know they are clean.</li>
<li>Optional (Disabled by default): Enable password checking against the API’s list of known passwords on password reset / new user password set. This only triggers if the user also has had their e-mail leaked in a known breach, and e-mails the user with additional information.</li>
</ul>
Planned for future updates:
<ul>
<li>(Toggleable) Method of checking existing users and notifying them.</li>
<li>(Toggleable) Method to periodically check all users that haven’t had a breach, and notify them if that changes.</li>
<li>(Toggleable) Method to add admin notifications of new breaches discovered by HaveIBeenPwned.com</li>
</ul>
<h3>Dependencies and Liscencing</h3>
This plugin relies on the the HaveIBeenPwned APIv2, and has been designed to comply with rate limiting and usage policy.

Alternatives to Signup Breach Checker

Top alternatives