WordPress Password Policy: Enforce a Minimum Length via Code or Plugin

This article is a localized edition of the Japanese original. Read the Japanese original

This article explains how to make WordPress users choose passwords of at least a certain strength. After checking what WordPress can and can't do out of the box, it shows how to enforce a minimum length and other rules with code, and how to do it with a plugin. It assumes WordPress as of October 2026.

What WordPress does out of the box

The WordPress profile screen and password reset screen include a password strength meter. It rates the password being typed as "Very weak," "Weak," "Medium" or "Strong," and when the password is weak, a "Confirm use of weak password" checkbox appears.

However, checking that box lets users save a weak password anyway. WordPress has no built-in setting to enforce a minimum length or required character types, and WP-CLI's standard commands have no command for setting password rules either. To enforce rules, add code or use a plugin.

Decide on the rules

Overly strict rules can lead to more password reuse and written-down passwords. The US NIST digital identity guidelines (SP 800-63B) put the emphasis on sufficient length and on rejecting passwords known to have been leaked, rather than on forcing character-type combinations or periodic changes.

The code example in this article uses these rules:

• At least 12 characters
• Must not contain the username

For rejecting leaked passwords, see Checking WordPress passwords against the HIBP (Have I Been Pwned) API.

Enforce a minimum length with code

The hook you can use for the check depends on the screen where the password is set.

Save the following code as wp-content/mu-plugins/password-policy.php (create the mu-plugins folder if it doesn't exist). Files in mu-plugins load automatically and can't be deactivated from the admin. It's an mu-plugin because if you put it in the theme's functions.php, the rules would disappear when you change themes.

<?php
/*
 * Plugin Name: Password policy
 * Description: Enforce a minimum password length and other rules
 */

/**
 * Return the rule violations as an array of messages (an empty array if there are none)
 */
function my_password_policy_messages( $password, $user_login = '' ) {
	$messages = array();

	if ( mb_strlen( $password ) < 12 ) {
		$messages[] = 'Your password must be at least 12 characters long.';
	}

	if ( '' !== $user_login && false !== mb_stripos( $password, $user_login ) ) {
		$messages[] = 'Your password must not contain your username.';
	}

	// Example if you also require character types (both letters and numbers)
	// if ( ! preg_match( '/[A-Za-z]/', $password ) || ! preg_match( '/[0-9]/', $password ) ) {
	// 	$messages[] = 'Your password must contain both letters and numbers.';
	// }

	return $messages;
}

// Profile, editing a user, adding a new user
add_action( 'user_profile_update_errors', function ( $errors, $update, $user ) {
	// Do nothing if the update doesn't change the password
	if ( empty( $user->user_pass ) ) {
		return;
	}

	$login = '';
	if ( ! empty( $user->user_login ) ) {
		$login = $user->user_login;
	} elseif ( ! empty( $user->ID ) ) {
		$existing = get_userdata( $user->ID );
		$login    = $existing ? $existing->user_login : '';
	}

	foreach ( my_password_policy_messages( wp_unslash( $user->user_pass ), $login ) as $i => $message ) {
		$errors->add( 'my_password_policy_' . $i, $message );
	}
}, 10, 3 );

// Password reset from the login screen
add_action( 'validate_password_reset', function ( $errors, $user ) {
	if ( is_wp_error( $user ) || empty( $_POST['pass1'] ) ) {
		return;
	}

	$password = wp_unslash( $_POST['pass1'] );

	foreach ( my_password_policy_messages( $password, $user->user_login ) as $i => $message ) {
		$errors->add( 'my_password_policy_' . $i, $message );
	}
}, 10, 2 );

When you add an error to $errors, the password is not saved and the message is shown on screen. Even if the user checks "Confirm use of weak password" on the strength meter, a password that breaks these rules is not saved.

Test it

1. Log in as a test user who is not an administrator, go to "Users" → "Profile," click "Set New Password," enter a password of 11 characters or fewer, and click "Update Profile"
2. Confirm that an error appears and the password hasn't changed (log out and check that you can log in with the old password)
3. Reset the password from "Lost your password?" on the login screen and confirm that a short password produces the same error

Screen labels may change between WordPress versions.

Paths this code doesn’t cover

If a password is set in any of the following ways, the hooks above don't run, so the rules are not applied.

• WP-CLI (wp user create, wp user update --user_pass=...)
• Registration or password-change forms provided by plugins or themes (such as WooCommerce's "My account")
• Your own code calling wp_set_password() or wp_update_user() directly
• Editing the database directly

If you use such a form, add the same check through the hooks that plugin provides, or use a password policy plugin that supports that form. Application passwords are long random strings generated by WordPress, so these rules don't apply to them.

Using a plugin

If you'd rather not write code, use a password policy plugin. For example, the free version of "Melapress Login Security" lets you set a minimum length, require uppercase and lowercase letters, numbers and symbols, set password expiration, and prevent reuse of previous passwords (according to its WordPress.org plugin page as of October 2026).

When choosing a plugin, check the following:

• The last updated date and the supported WordPress versions
• Whether the rules also apply to the forms your site uses (such as WooCommerce)
• Whether existing users can be required to change their password at next login
• If you set an expiration period, whether it is worth the burden on users (see also the NIST guidelines above)

Measures to combine with password rules

Password rules alone can't protect you when, for example, a reused password is leaked. Also consider these measures:

• Set up two-factor authentication for administrators and editors
• Limit login attempts
• Give administrator rights only to the people who need them

Summary

• WordPress's built-in strength meter only warns; it doesn't stop weak passwords from being saved
• You can enforce rules with user_profile_update_errors (profile, editing users, adding users) and validate_password_reset (password reset)
• They don't apply to WP-CLI, custom forms, or code that calls wp_set_password() directly
• Focus the rules on length and rejecting leaked passwords, and combine them with two-factor authentication

Related articles:

• How to customize WordPress password strength rules
• How to strengthen WordPress administrator passwords
• How to manage WordPress application passwords

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)