Simon Blackbourn

<p>This plugin redirects newly-registered users to the <em>Admin -> Edit Profile</em> page when they first log in. Until they have changed their password, they will not be able to access either the front-end or other admin pages. An admin notice is also displayed informing them that they must change their password.</p>
<p>New administrators must also change their password, but as a safety measure they can also access the <em>Admin -> Plugins</em> page.</p>
<h4>Translations included</h4>
<ul>
<li>Català (Catalan)</li>
<li>中文 (Chinese)</li>
<li>Nederlands (Dutch)</li>
<li>Français (French)</li>
<li>Deutsch (German)</li>
<li>Ελληνικά (Greek)</li>
<li>Hebrew</li>
<li>Hindi</li>
<li>Magyar (Hungarian)</li>
<li>Italiano (Italian)</li>
<li>日本語 (Japanese)</li>
<li>Khmer</li>
<li>한국어 (Korean)</li>
<li>Lietuvių kalba (Lithuanian)</li>
<li>македонски јазик (Macedonian)</li>
<li>Polski (Polish)</li>
<li>Português do Brasil (Brazilian Portuguese)</li>
<li>Português (Portuguese)</li>
<li>Română (Romanian)</li>
<li>Русский (Russian)</li>
<li>Español (Spanish)</li>
<li>Türkçe (Turkish)</li>
</ul>
<p>New translations are very welcome – please submit them via <a href="http://wp-translations.org/" rel="nofollow ugc">WP-Translations</a>. This plugin’s WP-Translations page is <a href="https://www.transifex.com/projects/p/force-password-change/" rel="nofollow ugc">transifex.com/projects/p/force-password-change</a></p>


Force Password Change

Require users to change their password on first login.

Bartosz Gadomski

Teydea Studio

<p><strong>Enhance your WordPress website’s security by forcing users to reset their passwords.</strong></p>
<p>Password Reset Enforcement is a simple yet powerful security plugin that allows site administrators to require users to update their passwords—ideal after a potential data breach, routine security checks, or during onboarding/offboarding processes.</p>
<h3>Features</h3>
<ul>
<li><strong>Force password reset for all users</strong>, specific user roles, or individual users.</li>
<li><strong>Optional email notification</strong> to users with a direct reset link.</li>
<li><strong>Flexible login behavior</strong>:
<ul>
<li><em>Allow login before resetting</em>: users log in with the old password, are immediately prompted to set a new one.</li>
<li><em>Block login until reset</em>: users must reset their password before accessing the dashboard.</li>
</ul>
</li>
<li><strong>Choose reset timing</strong>:
<ul>
<li><em>Immediately</em>: forces logout and password reset on next login.</li>
<li><em>After session expiry</em>: users are asked to reset after their current session ends.</li>
</ul>
</li>
<li><strong>WP-CLI support</strong> for command-line password management and automation.</li>
<li><strong>Multisite compatible</strong> (network-wide reset only).</li>
<li>Optimized for performance on large-scale and enterprise WordPress installations.</li>
</ul>
<h3>Use Cases</h3>
<ul>
<li>Responding to a <strong>security breach</strong> or suspected compromise.</li>
<li>Enforcing <strong>routine password changes</strong> in corporate environments.</li>
<li>Applying <strong>onboarding/offboarding security policies</strong> for teams or membership sites.</li>
</ul>
<h3>Compatibility</h3>
<ul>
<li>Works on both single-site and multisite (network) WordPress setups.</li>
<li>Supports PHP 7.4+ and WordPress 6.6 through 6.8.</li>
<li>Compatible with modern WordPress admin experience.</li>
</ul>
<h3>WP-CLI Commands</h3>
<p>This plugin provides WP-CLI commands for automated password reset management:</p>
<p><strong>Force Password Reset</strong><br />
    wp password-reset-enforcement force [–to_all] [–to_roles=] [–to_users=] [–applicability=] [–with_email] [–with_current_password_allowed] [–limit=] [–paged=]</p>
<p><strong>Clear Password Reset Enforcement</strong><br />
    wp password-reset-enforcement clear [–to_all] [–to_roles=] [–to_users=] [–limit=] [–paged=]</p>
<p><strong>List Users with Enforced Password Reset</strong><br />
    wp password-reset-enforcement list [–limit=] [–paged=]</p>
<p><strong>Check Password Reset Status</strong><br />
    wp password-reset-enforcement status [–to_all] [–to_roles=] [–to_users=] [–limit=] [–paged=]</p>
<h4>Command Options</h4>
<ul>
<li><code>--to_all</code>: Target all users on the site</li>
<li><code>--to_roles=<roles></code>: Comma-separated list of user roles (e.g., editor,administrator)</li>
<li><code>--to_users=<user_ids></code>: Comma-separated list of specific user IDs (e.g., 1,5,10)</li>
<li><code>--applicability=<when></code>: When reset takes effect (immediately, after_session_expiry)</li>
<li><code>--with_email</code>: Send email notifications to affected users (default: true)</li>
<li><code>--with_current_password_allowed</code>: Allow users to reuse current password (default: false)</li>
<li><code>--limit=<number></code>: Maximum users to process in single operation</li>
<li><code>--paged=<page></code>: Page number for pagination</li>
</ul>
<h4>Command Examples</h4>
<pre><code>wp password-reset-enforcement force --to_all
wp password-reset-enforcement force --to_roles=editor,administrator --applicability=after_session_expiry
wp password-reset-enforcement clear --to_users=1,5,10
wp password-reset-enforcement list --limit=50 --paged=2
wp password-reset-enforcement status --to_all --limit=50 --paged=2<h3>Related Plugins</h3>
</code></pre>
<p>Want to go beyond forced password resets? Check our <a href="https://wppasswordpolicy.com/?utm_source=Password+Reset+Enforcement" rel="nofollow ugc">WP Password Policy</a> plugin to enforce strong password rules, block weak passwords, and set automatic expiry policies — so you’ll never need to force a password reset again. [https://wordpress.org/plugins/password-requirements/](Free version available on WordPress.org).</p>


Password Reset Enforcement

Easily enforce password reset for WordPress users. Choose to force password changes site-wide, by user and/or by role, to boost your site's security.

Force Password Change vs Password Reset Enforcement