Password Policy Manager Enterprise and Premium Capabilities

Password Policy Manager helps WordPress administrators set password requirements and manage credential changes. Enterprise and Premium include password strength review, expiry, resets, first-login requirements, inactive-session controls, and multisite support.

Password rules and account changes

Set minimum and maximum password lengths and other administrator-defined constraints. A strength meter and password score classify passwords as strong, medium, or weak. Administrators can review visitors’ password strength and related password information.

• Password expiry: Choose a period after which visitors must create a new password.
• Change at next login: Require users to update their password the next time they sign in.
• One-click reset: Invalidate current passwords and require users to generate new ones.

When a reset is used for users, their current sessions are ended, and they must set a new strong password through email.

Enterprise plan controls

Enterprise includes controls for broader WordPress setups. Administrators can require selected roles to make strong passwords on their first login, log users out and destroy their sessions after a customizable period of inactivity, and apply password policies across a multisite network.

Premium plan controls

Premium includes Enterprise capabilities and includes policies for selected roles or individual users. Administrators can require selected users to create strong passwords at first login, require specific roles to change passwords at their next login, and use role-based one-click password reset and logout controls. Premium also supports custom login forms, including WooCommerce, Elementor, and Ultimate Member.

Set up the policies

Start with password length and strength constraints. Review password scores, then require a password change or use a one-click reset when needed. Assign policies by role or visitor where supported. On a multisite installation, configure the policy for the network. Install Password Policy Manager in WordPress, activate the paid edition, and configure its rules and enforcement settings. If using a supported custom login form, configure the relevant policy for that login experience. Test first-login, expiry, reset, and inactivity options with suitable accounts before applying them broadly.