Last updated: 10th July 2026 for CC Security Essentials Pro version 1.0

Introduction

Strong passwords are an important part of website security, but they should also be reviewed periodically.

Over time, passwords may become known to more people than intended, be reused elsewhere, or simply remain unchanged for much longer than an organisation considers appropriate.

CC Security Essentials Pro helps administrators monitor the age of user passwords by recording when passwords were last changed and highlighting accounts whose passwords may be due for review.

The feature provides visibility rather than automatically forcing password changes, allowing administrators to decide when action is appropriate.

Why Monitor Password Age?

Not every website requires regular password changes.

For many smaller websites, long, unique passwords combined with password managers and Login Protection provide excellent security.

Larger organisations, however, may have internal policies requiring passwords to be reviewed or changed after a defined period.

Password Age Monitoring helps administrators:

identify accounts with older passwords;
review privileged accounts more easily;
support organisational security policies;
decide whether a password change is appropriate.

It provides information rather than automatically enforcing action.

How Password Age Monitoring Works

Whenever a user changes their password, CC Security Essentials Pro records the date of the change.

For existing accounts where no previous password change has been recorded, the plugin uses the account creation date as a sensible starting point.

This allows the feature to begin working immediately without requiring every user to reset their password.

Viewing Password Age

Open:

Security → Password Age

The page lists users together with information about the age of their current password.

Depending on the current configuration, passwords approaching or exceeding the recommended review period may be highlighted to help administrators identify accounts that deserve attention.

The password itself is never displayed.

Understanding Password Age

Password age simply indicates how long the current password has been in use.

A password that has existed for a long time is not necessarily insecure.

Instead, password age provides useful context when reviewing account security.

For example:

an Administrator account using the same password for several years may deserve review;
a Subscriber account may present considerably less risk.

Password age should therefore be considered alongside:

account privileges;
password strength;
Login Protection;
organisational security policies.

Relationship with Password Policies

Password Age Monitoring does not evaluate password strength.

Instead, it complements Password Policies.

Password Policies help ensure that new passwords are sufficiently strong.

Password Age Monitoring helps identify when those passwords may be ready for review.

Together they provide a more complete picture of account security.

Relationship with Password Change Enforcement

Password Age Monitoring provides information.

Password Change Enforcement acts upon that information when organisational policy requires users to update their passwords.

Many websites will choose to use Password Age Monitoring on its own.

Others may combine both features.

Administrator Review

Password Age Monitoring makes it easier to identify accounts that may benefit from a password review.

When reviewing older passwords, consider:

whether the account is still required;
whether the user still has the same responsibilities;
whether the account has administrator privileges;
whether the password has been exposed elsewhere;
whether organisational policies recommend replacement.

Password age should be treated as one indicator among several rather than the sole measure of account security.

Best Practice

For most websites we recommend:

reviewing administrator accounts periodically;
encouraging the use of password managers;
combining Password Policies with Login Protection;
removing unused accounts;
changing passwords when there is reason to believe they may have been compromised.

Avoid changing passwords purely because a fixed period has elapsed unless this reflects your organisation’s security policy.

Common Questions

Does the plugin store passwords?

No.

CC Security Essentials Pro never stores user passwords.

Only information about when a password was last changed is recorded.

Will users be forced to change their password?

Not by Password Age Monitoring alone.

The feature simply records and reports password age.

If Password Change Enforcement is enabled, users may later be required to choose a new password according to your configured policy.

What happens to existing accounts?

Existing accounts continue to operate normally.

Where no previous password change has been recorded, the account creation date is used as the initial reference point.

Once the user changes their password, the recorded password age is updated automatically.

Does password age affect Login Protection?

No.

One protects against repeated failed login attempts.

The other helps administrators review account security over time.

Troubleshooting

Password ages seem older than expected

For accounts that existed before Password Age Monitoring was enabled, the account creation date is used until the password is changed for the first time.

After a password change, the recorded age reflects the new password.

Password age does not update

Confirm that the password was actually changed successfully.

If Password Policies are enabled, ensure that the replacement password satisfies the configured minimum strength.

Another plugin tracks password age

Some security plugins include similar functionality.

Running multiple password age monitoring systems may result in duplicate reports or inconsistent information.

Where practical, use a single system to monitor password age.

Privacy

Password Age Monitoring records only the information necessary to calculate the age of a password.

The password itself is never stored, displayed or transmitted.

Any recorded information remains on your website and is intended solely to help authorised administrators manage account security.

Continue with: