About this plugin
Cypress North Password Policy enforces a strong, modern password policy on your WordPress site. Defaults align with NIST 800-63B guidance: length over composition rules, denylist screening, breach-corpus checks, and rate-limited login. Every setting is admin-configurable.
What you get
- A password rule engine that validates on user registration, password reset, and profile updates — covering minimum length, character requirements, breach-corpus check via the Have I Been Pwned k-anonymity API, denylist of common passwords, edit-distance check against the current password, and a per-user history check.
- Layered failed-login lockout: separate thresholds per IP and per username, with rolling windows and auto-release. Generic “invalid credentials” error responses so locked state is not disclosed to attackers.
- A soft-force interstitial that catches users at next login when their password is expired, breached, or below the active policy — they cannot escape without choosing a compliant new password.
- Daily email summary for administrators when attack rates spike.
- Per-user notification emails on password change, lockout, and expiration warnings.
- GDPR exporter + eraser that integrate with WordPress’s built-in Personal Data tools.
- Audit log of every relevant event (login failures, lockouts, password changes, compliance state transitions) viewable in the admin.
- Cleanup cron that trims old failed-attempt rows on a configurable schedule.
- WP-CLI wp cnpp unlock command to release a stuck IP or username without opening the admin.
- Multisite-aware: super-admin can globally configure or delegate per-site management.
Designed to coexist with WordPress core
The plugin uses WordPress’s own password hashing ( wp_hash_password ) and never stores plaintext. The built-in zxcvbn strength meter is left intact. All integration is via documented WP filters and actions — deactivating the plugin removes its behavior cleanly.
External services
This plugin connects to an API to check for known breached passwords.
com) receives only the first five characters of a SHA-1 hash — k-anonymity. No personally identifying information leaves the site and no plain text is transmitted. The check can be disabled entirely from Settings → Password Policy → Policy.
com/): terms of use, privacy policy
Privacy
This plugin processes data necessary to enforce account security. The full privacy disclosure is contributed to Tools → Privacy Policy Guide when the plugin is active.
What is collected
- Failed login attempts (IP, username attempted, timestamp).
- Lockout events (identifier, lockout-until timestamp).
- Password-change audit-log rows.
- Per-user: timestamp of last password change, compliance flag, a small queue of one-way hashes of previous passwords, and the most recent HIBP breach-check result (if enabled).
Lawful basis
Legitimate interest in preventing brute-force credential attacks, plus regulatory and contractual obligations around password hygiene where applicable.
Retention
- Failed-attempt rows: pruned daily by cron, default kept for the duration of the lockout window (typically 24 hours).
- Audit-log rows: default 90 days, configurable.
- Per-user compliance and history data: kept while the user account exists; removed via the GDPR eraser on request.
Third parties
com) receives only the first five characters of a SHA-1 hash — k-anonymity. No personally identifying information leaves the site. The check can be disabled entirely from Settings → Password Policy → Policy.
Exporter + eraser
The plugin registers with WordPress’s built-in Personal Data tools (Tools → Export Personal Data, Tools → Erase Personal Data). Exports return four groups (failed attempts, lockouts, password-change events, compliance state). Erasure removes the password-change audit rows and every plugin-specific user_meta entry; lockout and failed-attempt rows are retained with the username field redacted so aggregate-attack statistics remain intact but the rows can no longer be linked to the individual.