Password Policies Configuration

Why Password Policies Matter

Strong password policies are essential for:

• 🛡️ Preventing unauthorized access
• 📋 Meeting compliance requirements (HIPAA, GDPR, PCI-DSS)
• 🔒 Protecting sensitive data
• 👥 Enforcing organizational security standards
• ⚠️ Reducing risk of brute force attacks

Accessing Password Policy Settings

1. Navigate to User Access → Security
2. Click the “Password Policies” tab
3. Toggle “Enable Password Policies” to ON

Password Strength Requirements

Minimum Length

• Recommended: 12 characters minimum
• Standard: 8 characters minimum
• High Security: 16 characters minimum

Character Requirements

Configuration Example

Minimum Password Length: 12
Require Uppercase: Yes (at least 1)
Require Lowercase: Yes (at least 1)
Require Numbers: Yes (at least 1)
Require Special Characters: Yes (at least 1)
Block Common Passwords: Yes
Block Username in Password: Yes
Block Email in Password: Yes

Password Expiration Policies

Enable Password Expiration

1. Toggle “Password Expiration” to ON
2. Set “Expiration Period” in days
3. Configure “Grace Period” for warnings

Recommended Settings:

Expiration Warning Notifications

• Email Reminders: Send warnings before expiration
• Login Notices: Display banner when password expires soon
• Dashboard Widget: Show expiration status

Password History Rules

Prevent Password Reuse

1. Enable “Password History”
2. Set “Remember Previous Passwords” count
3. Recommended: Remember last 5-10 passwords

Password History Settings:
Remember Last: 10 passwords
Minimum Password Age: 1 day
(Prevents changing password multiple times to bypass history)

Role-Based Password Policies

Apply different policies to different user roles:

Blocked Password Lists

Common Password Blocking

• Block top 10,000 common passwords
• Block passwords from data breaches (HaveIBeenPwned integration)
• Block custom organizational terms

Add Custom Blocked Passwords:

1. Go to Password Policies → Blocked List
2. Add terms one per line:

companyname
company123
office2025
[your-organization-name]
[product-names]
[common-internal-terms]

Password Reset Policies

Reset Requirements

• Require Password Change on First Login: Force new users to set unique password
• Admin Password Resets: Require users to change after admin reset
• Suspicious Activity: Force reset after detected security events

Self-Service Password Reset

1. Enable “Password Reset Link” on login page
2. Configure “Reset Email Template”
3. Set “Reset Link Expiration” (default: 24 hours)
4. Limit “Reset Attempts” (recommended: 3 per hour)

User Experience Considerations

Password Strength Meter

• ✅ Enable real-time password strength indicator
• ✅ Show requirement checklist
• ✅ Provide helpful suggestions

Custom Validation Messages

Customize error messages for better user experience:

Default: "Password must contain at least one uppercase letter"
Custom: "Please include a capital letter (A-Z) in your password"

Default: "Password too short"
Custom: "Your password needs at least 12 characters for security"

Testing Your Password Policies

Test Checklist:

• ✅ Try weak password (should be rejected)
• ✅ Test minimum length requirement
• ✅ Verify complexity requirements work
• ✅ Test password history (try reusing old password)
• ✅ Verify blocked passwords are rejected
• ✅ Test expiration warnings appear
• ✅ Confirm different roles have correct policies
• ✅ Test password reset flow

Compliance & Security Standards

NIST Guidelines (800-63B)

• Minimum 8 characters (12+ recommended)
• Check against breach databases
• No composition rules that reduce entropy
• No mandatory periodic password changes without reason

PCI-DSS Requirements

• Minimum 7 characters (complex)
• Change every 90 days
• Cannot reuse last 4 passwords
• Lock account after 6 failed attempts

HIPAA Recommendations

• Unique user identification
• Emergency access procedures
• Automatic logoff
• Encryption of passwords

Advanced Configuration

Developer Hooks

// Custom password validation
add_filter('attrua_password_strength', function($is_valid, $password, $user) {
    // Add custom validation logic
    if (strpos($password, 'custom_term') !== false) {
        return new WP_Error('weak_password', 'Password contains restricted term');
    }
    return $is_valid;
}, 10, 3);

// Modify password expiration
add_filter('attrua_password_expiry_days', function($days, $user) {
    if (in_array('administrator', $user->roles)) {
        return 60; // Admins: 60 days
    }
    return $days; // Others: default
}, 10, 2);

// Custom blocked passwords
add_filter('attrua_blocked_passwords', function($blocked_list) {
    $custom_terms = ['company2025', 'office123'];
    return array_merge($blocked_list, $custom_terms);
});

Troubleshooting

Best Practices Summary

Monitoring & Auditing

Track password policy effectiveness:

• Review password change logs
• Monitor failed login attempts
• Track policy violation attempts
• Analyze password reset frequency
• Generate compliance reports

Navigate to User Access → Audit Logs → Password Events to view detailed reports.