Passwords of at least 12 characters
Users can’t set a password shorter than 12 characters when they reset it, register or edit their profile.
<?php
$snipfire_check_password = static function ( $errors, $password ) {
if ( '' !== (string) $password && mb_strlen( (string) $password ) < 12 ) {
$errors->add( 'snipfire_short_password', 'Please use a password of at least 12 characters.' );
}
};
// Profile and user screens.
add_action(
'user_profile_update_errors',
static function ( $errors ) use ( $snipfire_check_password ) {
// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Checked by WordPress.
$snipfire_check_password( $errors, isset( $_POST['pass1'] ) ? wp_unslash( $_POST['pass1'] ) : '' );
}
);
// "Lost your password?" reset form.
add_action(
'validate_password_reset',
static function ( $errors ) use ( $snipfire_check_password ) {
// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Checked by WordPress.
$snipfire_check_password( $errors, isset( $_POST['pass1'] ) ? wp_unslash( $_POST['pass1'] ) : '' );
}
);
Good to know
Existing passwords keep working. WooCommerce account forms have their own strength meter.
In these packs
- Users and profiles: Registration dates, last logins, social profile fields, longer sessions and stricter passwords.
- Login and security extras: Limit login attempts, email-only logins, a registration spam trap and more hardening.