Password Policy Manager Enterprise and Premium Capabilities

Password Policy Manager gives WordPress administrators tools to set password requirements and manage credential changes. Enterprise and Premium add password strength review, expiry, resets, first-login requirements, inactive-session controls, and multisite support.

Password rules and credential changes

Administrators can set minimum and maximum password lengths and other constraints they define. A strength meter and password score classify passwords as strong, medium, or weak. The administration workflow also works with reviewing customers' password strength and related password information.

• Password expiry: Set a period after which users must create a new password.
• Change at next login: Require users to change their password the next time they log in.
• One-click reset: Invalidate current passwords and require users to generate new ones.

When a reset is used for users, their current sessions are killed and they must set a new strong password through email.

How Enterprise and Premium policies differ

Enterprise can require users in selected roles to create strong passwords at first login. Administrators can also log out inactive users and destroy their sessions after a customizable period. Multisite support lets administrators create password policies for an entire WordPress network.

Premium supports password policies for selected roles or individual users. Administrators can require selected users to create strong passwords at first login, require specific roles to change passwords at their next login, and use role-based one-click password reset and logout controls. Premium also supports custom login forms, including WooCommerce, Elementor, and Ultimate Member. It includes the Enterprise capabilities for inactive-user logout and multisite policy management.

Set up the policy

Start by setting password length and strength constraints. Review password scores to identify weak credentials, then require a password change or use a one-click reset when needed. For various account groups, assign policies by role or user. On a multisite installation, configure the policy for the network.

Install and activate the appropriate edition in WordPress, then configure its password rules and enforcement options. If you use a supported custom login form, configure the relevant policy for that login experience. Test first-login, expiry, reset, and inactivity settings with suitable accounts before applying them broadly.