Carsten Bach

Cornel Raiu

Carl Alexander

riper81

Celso Bessa

<p><strong>Important Notice:</strong> This plugin is no longer supported on wordpress.org. Please open issues on <a href="https://github.com/carlalexander/passwords-evolved/issues" rel="nofollow ugc">GitHub</a>.</p>
<p>The goal of this plugin is to shore up the WordPress authentication using standard security practice recommendations. At this time, the plugin improves WordPress authentication by doing the following:</p>
<h4>Enforcing uncompromised passwords</h4>
<p>This plugin prevents someone from using passwords that have appeared in data breaches. Whenever someone logs into a WordPress site, it’ll verify their password using the <a href="https://haveibeenpwned.com/API/v2" rel="nofollow ugc">Have I been pwned? API</a>. If their password appeared in a data breach, the plugin will prevent them from logging in until they reset their password.</p>
<p>By default, this level of enforcement is only done on an account that has the “<a href="https://codex.wordpress.org/Roles_and_Capabilities#Administrator" rel="nofollow ugc">administrator</a>” role. You can change which roles have their passwords enforced from the settings page. For people that have a role where there’s no password enforcement, the plugin will show a warning when they log in with a compromised password.</p>
<p>The enforcement of uncompromised password also extends to when someone resets or changes their password. That said, in those situations, using an uncompromised password is mandatory. Someone will never be able to reset or change their password to one that’s appeared in a security breach. (As long as the plugin is able to contact the API.)</p>
<h4>Using stronger password hashing</h4>
<p>The plugin also encrypts passwords using either the <a href="https://en.wikipedia.org/wiki/Bcrypt" rel="nofollow ugc">bcrypt</a> and <a href="https://en.wikipedia.org/wiki/Argon2" rel="nofollow ugc">Argon2</a> hashing functions. These are the strongest hashing functions available in PHP. Argon2 is available natively starting with PHP 7.2, but the plugin can also encrypt passwords on older PHP versions using the <a href="https://libsodium.org" rel="nofollow ugc">libsodium</a> compatibility layer introduced in WordPress 5.2.</p>
<p>You don’t have to do anything to convert your password hash to a stronger encryption standard. The plugin will take care of converting it the next time that you log in after installing the plugin. If you decide to remove the plugin, your password will continue working and remain encrypted until you reset it.</p>
<p>It’s also worth noting that using a stronger hashing function is only important in the advent of a data breach. A stronger password hashing function makes decrypting the passwords from the data breach a lot harder to do. This combined with the enforcement of uncompromised passwords will help ensure that those passwords are never decrypted. (Or at least without significant effort.)</p>


Passwords Evolved

This seems to work very well, at least no issues - immediate or long term. A client user was very surprised that "WordPress" could know their password was "pwned", but thankful for the reminder.

Beware that if you deactivate this plugin, users have to reset their passwords. So just keep it - for the enhanced security through a modern and relatively simple plugin.

Should be added to core, IMO.

Great enhancement and well made

A reimagining of WordPress authentication using modern security practices.

Bartosz Gadomski

Teydea Studio

<p><strong>Enhance your WordPress website’s security by forcing users to reset their passwords.</strong></p>
<p>Password Reset Enforcement is a simple yet powerful security plugin that allows site administrators to require users to update their passwords—ideal after a potential data breach, routine security checks, or during onboarding/offboarding processes.</p>
<h3>Features</h3>
<ul>
<li><strong>Force password reset for all users</strong>, specific user roles, or individual users.</li>
<li><strong>Optional email notification</strong> to users with a direct reset link.</li>
<li><strong>Flexible login behavior</strong>:
<ul>
<li><em>Allow login before resetting</em>: users log in with the old password, are immediately prompted to set a new one.</li>
<li><em>Block login until reset</em>: users must reset their password before accessing the dashboard.</li>
</ul>
</li>
<li><strong>Choose reset timing</strong>:
<ul>
<li><em>Immediately</em>: forces logout and password reset on next login.</li>
<li><em>After session expiry</em>: users are asked to reset after their current session ends.</li>
</ul>
</li>
<li><strong>WP-CLI support</strong> for command-line password management and automation.</li>
<li><strong>Multisite compatible</strong> (network-wide reset only).</li>
<li>Optimized for performance on large-scale and enterprise WordPress installations.</li>
</ul>
<h3>Use Cases</h3>
<ul>
<li>Responding to a <strong>security breach</strong> or suspected compromise.</li>
<li>Enforcing <strong>routine password changes</strong> in corporate environments.</li>
<li>Applying <strong>onboarding/offboarding security policies</strong> for teams or membership sites.</li>
</ul>
<h3>Compatibility</h3>
<ul>
<li>Works on both single-site and multisite (network) WordPress setups.</li>
<li>Supports PHP 7.4+ and WordPress 6.6 through 6.8.</li>
<li>Compatible with modern WordPress admin experience.</li>
</ul>
<h3>WP-CLI Commands</h3>
<p>This plugin provides WP-CLI commands for automated password reset management:</p>
<p><strong>Force Password Reset</strong><br />
    wp password-reset-enforcement force [–to_all] [–to_roles=] [–to_users=] [–applicability=] [–with_email] [–with_current_password_allowed] [–limit=] [–paged=]</p>
<p><strong>Clear Password Reset Enforcement</strong><br />
    wp password-reset-enforcement clear [–to_all] [–to_roles=] [–to_users=] [–limit=] [–paged=]</p>
<p><strong>List Users with Enforced Password Reset</strong><br />
    wp password-reset-enforcement list [–limit=] [–paged=]</p>
<p><strong>Check Password Reset Status</strong><br />
    wp password-reset-enforcement status [–to_all] [–to_roles=] [–to_users=] [–limit=] [–paged=]</p>
<h4>Command Options</h4>
<ul>
<li><code>--to_all</code>: Target all users on the site</li>
<li><code>--to_roles=<roles></code>: Comma-separated list of user roles (e.g., editor,administrator)</li>
<li><code>--to_users=<user_ids></code>: Comma-separated list of specific user IDs (e.g., 1,5,10)</li>
<li><code>--applicability=<when></code>: When reset takes effect (immediately, after_session_expiry)</li>
<li><code>--with_email</code>: Send email notifications to affected users (default: true)</li>
<li><code>--with_current_password_allowed</code>: Allow users to reuse current password (default: false)</li>
<li><code>--limit=<number></code>: Maximum users to process in single operation</li>
<li><code>--paged=<page></code>: Page number for pagination</li>
</ul>
<h4>Command Examples</h4>
<pre><code>wp password-reset-enforcement force --to_all
wp password-reset-enforcement force --to_roles=editor,administrator --applicability=after_session_expiry
wp password-reset-enforcement clear --to_users=1,5,10
wp password-reset-enforcement list --limit=50 --paged=2
wp password-reset-enforcement status --to_all --limit=50 --paged=2<h3>Related Plugins</h3>
</code></pre>
<p>Want to go beyond forced password resets? Check our <a href="https://wppasswordpolicy.com/?utm_source=Password+Reset+Enforcement" rel="nofollow ugc">WP Password Policy</a> plugin to enforce strong password rules, block weak passwords, and set automatic expiry policies — so you’ll never need to force a password reset again. [https://wordpress.org/plugins/password-requirements/](Free version available on WordPress.org).</p>


Password Reset Enforcement

Easily enforce password reset for WordPress users. Choose to force password changes site-wide, by user and/or by role, to boost your site's security.

Passwords Evolved vs Password Reset Enforcement