Who sets the rules and what users see

Password Policy Manager gives WordPress administrators controls for password requirements and credential changes. Administrators can set minimum and maximum password lengths and other constraints. The strength meter and password score classify passwords as strong, medium, or weak, while the administration workflow lets administrators review users' password strength and related information.

Credential changes and resets

• Password expiry: Set a period after which users must create a new password.
• Change at next login: Require users to change their password the next time they log in.
• One-click reset: Invalidate current passwords and require users to generate new ones.

When an administrator resets users' passwords, their current sessions are ended. Users then set a new strong password through email.

Enterprise plan scope

The Enterprise plan includes controls for WordPress sites with different account roles or a multisite network.

• Require selected roles to create strong passwords on their first login.
• Log out inactive users and destroy their sessions after a customizable period.
• Create password policies for an entire WordPress multisite network.

Premium plan scope

Premium includes the Enterprise capabilities for inactive-visitor logout and multisite policy management. It also lets administrators apply policies by role or individual user.

• Require selected users to create strong passwords on their first login.
• Require specific roles to change passwords at their next login.
• Use role-based one-click password reset and logout controls.
• Support custom login forms, including WooCommerce, Elementor, and Ultimate Member.

Apply the policy

Start by setting password length and strength constraints. Administrators can review password scores, then require a password change or use a one-click reset when credentials need to be replaced. For different account groups, assign policies by role or user. On multisite, configure the policy for the network rather than managing each site separately.

Install Password Policy Manager in WordPress, activate the paid edition, and configure its rules and enforcement options. If you use a supported custom login form, configure the relevant policy for that login experience. Test first-login, expiry, reset, and inactivity settings with suitable accounts before applying them broadly.