PHPackages bbs-lab/wordpress-password-policy - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Security](/categories/security) 4. / 5. bbs-lab/wordpress-password-policy ActiveWordpress-plugin[Security](/categories/security) bbs-lab/wordpress-password-policy ================================= WordPress plugin: configurable password complexity and mandatory rotation for privileged accounts. 1.1.0(today)04↑2900%GPL-2.0-or-laterPHPPHP >=7.4 Since Aug 6Pushed todayCompare [ Source](https://github.com/BBS-Lab/wordpress-password-policy)[ Packagist](https://packagist.org/packages/bbs-lab/wordpress-password-policy)[ Docs](https://github.com/BBS-Lab/wordpress-password-policy)[ RSS](/packages/bbs-lab-wordpress-password-policy/feed)WikiDiscussions main Synced today READMEChangelog (2)DependenciesVersions (3)Used By (0) BBS Password Policy =================== [](#bbs-password-policy) [![Latest release](https://camo.githubusercontent.com/e29373d88e5102de4e8409c54b7a1a89c8c622fcc5159897c2e70b51dd4889b8/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f762f72656c656173652f4242532d4c61622f776f726470726573732d70617373776f72642d706f6c6963793f7374796c653d666c61742d737175617265)](https://github.com/BBS-Lab/wordpress-password-policy/releases)[![License](https://camo.githubusercontent.com/af62659b004c9715a40b2fcb75701790e70146cd049bbfbeac4c0ae385a1f795/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c6963656e73652f4242532d4c61622f776f726470726573732d70617373776f72642d706f6c6963793f7374796c653d666c61742d737175617265)](LICENSE.md)[![PHP](https://camo.githubusercontent.com/f53fab9be0f45ba44b8821c31fd7d79200a9335369e605f21af3e8fc27832f72/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d253345253344253230372e342d3737374242343f7374796c653d666c61742d737175617265)](https://www.php.net/)[![WordPress](https://camo.githubusercontent.com/9627947d85579bb0c92217000132f1103374bf9958114338eeedf4a63003e876/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f576f726450726573732d253345253344253230362e302d3231373539423f7374796c653d666c61742d737175617265)](https://wordpress.org/) Enforce **configurable password complexity** and **mandatory password rotation** for WordPress privileged accounts (administrators by default). Light, self-contained, and ready for compliance use-cases such as CNSR: **15+ characters**, **3 of 4 character classes**, **90-day rotation**. Built by [Big Boss Studio](https://big-boss-studio.com/fr). Features -------- [](#features) - Forces strong passwords: minimum length + N of 4 character classes (upper / lower / digit / special) - Blocks WordPress “Confirm use of weak password” bypass on create / edit for targeted roles - Mandatory rotation every N days, with admin redirect until the password is renewed - Pre-expiry warning notice in wp-admin - Role-scoped enforcement (default: `administrator` only) and optional user-ID exclusions - Validates profile, user-new, user-edit, password reset, and REST user create/update - English source strings + French translations (`fr_FR`) - Settings UI under **Settings → Password Policy** (`manage_options`) - Clean uninstall (options + user meta, filterable) Requirements ------------ [](#requirements) - PHP `>= 7.4` - WordPress `>= 6.0` Installation ------------ [](#installation) ### From GitHub [](#from-github) ``` cd wp-content/plugins git clone https://github.com/BBS-Lab/wordpress-password-policy.git bbs-password-policy ``` Or download a [release ZIP](https://github.com/BBS-Lab/wordpress-password-policy/releases), then **Plugins → Add New → Upload Plugin**. ### Activate [](#activate) 1. Activate **BBS Password Policy** 2. Open **Settings → Password Policy** 3. Adjust roles / complexity / rotation if needed (CNSR defaults are already set) On activation, existing users in target roles receive a fresh “last changed” timestamp so they are **not** locked out immediately. Quick start (defaults) ---------------------- [](#quick-start-defaults) SettingDefaultEnabled`true`Target roles`administrator`Minimum length`15`Character classesupper, lower, digit, specialRequired classes`3` of 4RotationenabledRotation period`90` daysWarning window`14` daysForce change in admin`true`Length and complexity are **independent** checks: a password must satisfy **both** the minimum length **and** the N-of-4 rule. > On **Add New User**, the form defaults to `subscriber`. The policy only applies when the selected role is in **Target roles** (e.g. Administrator). Configuration ------------- [](#configuration) All options live in the `bbs_pp_settings` option and are edited in **Settings → Password Policy**. KeyDefaultDescription`enabled``true`Master switch`target_roles``['administrator']`Roles that must comply`min_length``15`Minimum password length (sanitized ≥ 8)`require_uppercase``true`Count uppercase toward complexity`require_lowercase``true`Count lowercase toward complexity`require_digit``true`Count digits toward complexity`require_special``true`Count special characters toward complexity`min_character_classes``3`How many enabled classes are required (1–4)`rotation_enabled``true`Require periodic renewal`rotation_days``90`Password lifetime in days`warning_days``14`Admin notice window before expiry`force_change_on_login``true`Redirect expired users to their profile in wp-admin`exclude_user_ids``[]`User IDs that bypass the policyUsage ----- [](#usage) ### Complexity [](#complexity) When a targeted user sets or resets a password (profile, user-new, user-edit, reset form, REST), the plugin validates length and character classes. Invalid passwords are rejected server-side; the admin UI also keeps **Add / Update** disabled until the policy passes and hides the weak-password confirmation checkbox. ### Rotation [](#rotation) Each successful password change stores a Unix timestamp in user meta `bbs_pp_password_last_changed`. When the password is older than `rotation_days`: 1. The user can still sign in (if force-change is on) 2. wp-admin requests redirect to **Profile** 3. An error notice asks for a new password 4. After a successful change, the timestamp resets and access is restored ### Profile panel [](#profile-panel) Targeted users (and admins editing them) see policy summary, last change date, and days remaining on the profile screen. Developer API ------------- [](#developer-api) ### Filters [](#filters) ``` add_filter( 'bbs_pp_validate_password', function ( WP_Error $errors, string $password ) { return $errors; }, 10, 2 ); // Keep user meta on uninstall (default: purge). add_filter( 'bbs_pp_uninstall_purge_user_meta', '__return_false' ); ``` ### Helpers [](#helpers) ``` $plugin = bbs_password_policy(); $plugin->settings()->applies_to_user( $user ); $plugin->validator()->validate( 'SomePassword123!' ); $plugin->rotation()->is_expired( $user ); $plugin->rotation()->days_until_expiry( $user ); ``` ### Storage [](#storage) KeyTypePurpose`bbs_pp_settings`optionPlugin settings array`bbs_pp_password_last_changed`user metaLast password change (Unix timestamp)`bbs_pp_must_change_password`user metaForce-renewal flagDirectory structure ------------------- [](#directory-structure) ``` bbs-password-policy/ ├── bbs-password-policy.php ├── uninstall.php ├── composer.json ├── README.md ├── CHANGELOG.md ├── LICENSE.md ├── SECURITY.md ├── readme.txt ├── includes/ ├── admin/ │ ├── class-admin-page.php │ ├── views/ │ └── assets/ │ ├── css/ │ └── js/ └── languages/ ``` Security -------- [](#security) Passwords are never stored by this plugin — WordPress hashing only. Settings require `manage_options`. If you discover a security vulnerability, please email **** instead of using the public issue tracker. See [SECURITY](SECURITY.md) for details. Changelog --------- [](#changelog) Please see [CHANGELOG](CHANGELOG.md) for what has changed recently. Credits ------- [](#credits) - [Big Boss Studio](https://github.com/BBS-Lab) License ------- [](#license) GPL-2.0-or-later. Please see [License File](LICENSE.md) for more information. ### Health Score 38 — LowBetter than 83% of packages Maintenance100 Actively maintained with recent releases Popularity5 Limited adoption so far Community7 Small or concentrated contributor base Maturity34 Early-stage or recently created project Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~0 days Total 2 Last Release 0d ago ### Community Maintainers ![](https://avatars.githubusercontent.com/u/5689944?v=4)[Mikaël Popowicz](/maintainers/mikaelpopowicz)[@mikaelpopowicz](https://github.com/mikaelpopowicz) ![](https://www.gravatar.com/avatar/c1edc17683ed39a2cc6dbe453c2c5aaa63468fc5b54f13941f260ebe260da211?d=identicon)[Kezho](/maintainers/Kezho) --- Top Contributors [![antoinecorbin7](https://avatars.githubusercontent.com/u/167988075?v=4)](https://github.com/antoinecorbin7 "antoinecorbin7 (5 commits)") --- Tags wordpresssecuritypasswordrotationPolicybbs-lab ### Embed Badge ![Health badge](/badges/bbs-lab-wordpress-password-policy/health.svg) ``` [![Health](https://phpackages.com/badges/bbs-lab-wordpress-password-policy/health.svg)](https://phpackages.com/packages/bbs-lab-wordpress-password-policy) ``` ### Alternatives [rych/phpass PHP Password Library: Easy, secure password management for PHP 253862.9k4](/packages/rych-phpass)[jeremykendall/password-validator Password Validator validates password\_hash generated passwords, rehashes passwords as necessary, and will upgrade legacy passwords. 14470.9k3](/packages/jeremykendall-password-validator)[brain/nonces OOP package for WordPress to deal with nonces. 26240.3k1](/packages/brain-nonces)[ph-7/passcode-password-generator A simple way to generate random cryptographically secure passcodes and passwords 1228.7k7](/packages/ph-7-passcode-password-generator)[pentagonal/phpass PHP password hashing library original by open wall PhPass 121.6k](/packages/pentagonal-phpass) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)