How plan scope changes WordPress password controls

Password Policy Manager lets administrators define password constraints and manage credential changes. Enterprise and Premium include password strength review, expiry, first-login requirements, resets, inactive-session controls, and multisite policies. Enterprise adds first-login enforcement by role; Premium adds policies by role or user.

Password rules and account changes

Set minimum and maximum password lengths and other administrator-defined constraints. A strength meter and score classify passwords as strong, medium, or weak. Administrators can review visitors’ password strength and related password information.

• Password expiry: Set a period after which users must create a new password.
• Change at next login: Require users to change their password the next time they log in.
• One-click reset: Invalidate current passwords and require users to generate new ones. When an administrator resets passwords for users, their current sessions are ended and they must set a new strong password through email.

Enterprise controls

• Require selected roles to create strong passwords on first login.
• Log out inactive users and destroy their sessions after a customizable period.
• Set password policies for an entire WordPress multisite network.

Premium controls

Premium includes the Enterprise capabilities and adds role-based and user-based policies. Administrators can require selected users to create strong passwords on first login, require specific roles to change passwords at their next login, and use role-based one-click password reset and logout controls.

Premium supports custom login forms, including WooCommerce, Elementor, and Ultimate Member. Configure the relevant policy for the login form in use.

Configuration process

Install Password Policy Manager in WordPress, activate the paid edition, and set password length and strength constraints. Review password scores, then require a change at next login or use a one-click reset when needed. For different account groups, assign policies by role or user. On multisite, configure the policy for the network. Test first-login, expiry, reset, and inactivity options with suitable accounts before applying them broadly.