Frankie Jarrett

Matt Miller

Miller Media

Note: This is a forked version of the now unsupported <a href="https://wordpress.org/plugins/expire-passwords/" rel="ugc">Expire Passwords</a> plugin. The notes below are copied over from the original plugin and will be updated as relevant updates become available. Please help by contributing to the GitHub repository <a href="https://github.com/Miller-Media/expire-passwords" rel="nofollow ugc">Expire Passwords</a> on GitHub
Did you find this plugin helpful? Please consider <a href="https://wordpress.org/support/view/plugin-reviews/expire-user-passwords" rel="ugc">leaving a 5-star review</a>.
Harden the security of your site by preventing unauthorized access to stale user accounts.
This plugin is also ideal for sites needing to meet certain industry security compliances – such as government, banking or healthcare.
In the plugin settings you can set the maximum number of days users are allowed to use the same password (90 days by default), as well as which user roles will be required to reset their passwords regularly (non-Administrators by default).
Languages supported:
<ul>
<li>English</li>
<li>Czech</li>
<li>Español</li>
</ul>
Development of this plugin is done <a href="https://github.com/Miller-Media/expire-passwords" rel="nofollow ugc">on GitHub</a>. Pull requests welcome. Please see <a href="https://github.com/Miller-Media/expire-passwords/issues" rel="nofollow ugc">issues reported</a> there before going to the plugin forum.

Expire User Passwords

Require certain users to change their passwords on a regular basis.

Rik Lewis

bettersecurity

This plugin sets a default minimum password length of 10 characters, to ensure that passwords are suitably long that they are hard to guess. However, it does not insist on any complexity rules, such as digits and special characters, as length is the most important thing when making a password hard to guess.
This plugin uses Troy Hunt’s <a href="https://haveibeenpwned.com/Passwords" rel="nofollow ugc">Pwned Passwords API</a> in order to check a user’s potential password against a corpus of breached passwords.
The password itself is never sent to any third party, only a partial hash is sent. This means that the password entered will always be private.
As an added bonus, this plugin also upgrades the hashing algorithm used when storing your password in the database. This is a secure one-way hash created using the <a href="https://en.wikipedia.org/wiki/Bcrypt" rel="nofollow ugc">Bcrypt</a> or <a href="https://en.wikipedia.org/wiki/Argon2" rel="nofollow ugc">Argon2</a> algorithm.

Better Passwords

I use this plugin on all of my sites - it not only checks if a used password is included in a haveibeenpwned.com leak, but also forces Wordpress to use more secure hashing algorithms for saving passwords. Highly recommended!

Recommended plugin


Perfect for my needs, as it doesn't attempt to enforce overly complex password rules, it just allows me to set a minimum length, and checks new passwords against Have I Been Pwned to make sure it's not been previously included in a breach. Can also store passwords using stronger hashing algorithms than the WordPress default.


Perfect for my needs

Stop use of a bad passwords, including those in the Have I Been Pwned? breached password database

Expire User Passwords vs Better Passwords