Last updated: 10th July 2026 for CC Security Essentials Pro version 1.0

Introduction

Some organisations require users to change their passwords periodically as part of their security policy.

CC Security Essentials Pro can require users to choose a new password when their existing password has reached the configured review period.

The feature works alongside Password Policies and Password Age Monitoring to help organisations implement consistent password management.

For many smaller websites, Password Change Enforcement may not be necessary. Long, unique passwords stored in a password manager often provide excellent security without requiring routine password changes.

Why Use Password Change Enforcement?

Password Change Enforcement is intended for websites where password changes form part of an established security policy.

Typical examples include:

business websites;
membership organisations;
educational institutions;
websites with multiple administrators;
websites managed by several editors or content teams.

Rather than relying on administrators to remember when passwords should be updated, the plugin helps apply the policy consistently.

How It Works

Password Change Enforcement uses the password age information maintained by Password Age Monitoring.

When a user’s password reaches the configured review period, the next successful login redirects them to a password change screen before they can continue using the website.

The user must choose a replacement password that satisfies the Password Policy configured for their WordPress role.

Once the password has been changed successfully, normal access resumes immediately.

The Password Change Screen

When a password change is required, users are presented with a dedicated password update screen.

The screen includes:

a clear explanation that a password change is required;
fields for entering and confirming the new password;
the standard WordPress password strength indicator;
a password generator;
an option to show or hide the entered password.

The process is designed to be familiar to anyone who has previously changed a WordPress password.

Relationship with Password Policies

Password Change Enforcement does not determine whether a password is sufficiently strong.

Instead, Password Policies define the minimum acceptable strength.

When a user selects a new password, both features work together:

Password Change Enforcement requires a new password.
Password Policies confirm that the password satisfies the configured requirement.

Relationship with Password Age Monitoring

Password Age Monitoring identifies passwords that may require review.

Password Change Enforcement applies the organisation’s policy by requiring users to replace those passwords when appropriate.

Many websites will choose to use Password Age Monitoring without enabling Password Change Enforcement.

Recommended Approach

For many websites we recommend introducing these features gradually:

Enable Password Policies.
Review Password Age Monitoring.
Allow users time to become familiar with stronger passwords.
Enable Password Change Enforcement only if your organisation requires regular password changes.

This staged approach helps reduce disruption while improving account security.

Best Practice

Password Change Enforcement is most effective when combined with:

Login Protection;
Password Policies;
Password Age Monitoring;
password managers;
regular review of administrator accounts.

Remember that password changes alone do not protect against every type of attack.

Good overall account security also depends upon:

strong, unique passwords;
removing unused accounts;
protecting administrator devices;
keeping WordPress and plugins up to date.

Common Questions

Will users lose access to their account?

No.

Users are still able to sign in successfully.

If a password change is required, they are simply guided through the password update process before continuing.

Can users ignore the password change?

No.

Where Password Change Enforcement is active, users must choose a new password before continuing to use the website.

Does the plugin choose passwords automatically?

No.

Users choose their own password or use the built-in WordPress password generator.

The plugin simply checks that the chosen password satisfies the configured Password Policy.

Will the plugin remember old passwords?

No.

CC Security Essentials Pro does not store previous passwords.

It records only the information required to determine when the current password was last changed.

Does this replace the WordPress password system?

No.

The plugin builds upon the standard WordPress password management process.

It uses familiar WordPress password fields, strength evaluation and password generation.

Troubleshooting

Users are not asked to change their password

Confirm that:

Password Change Enforcement is enabled;
Password Age Monitoring is active;
the configured password review period has been reached;
the user has successfully signed in.

Users whose passwords have not yet reached the configured review period will continue to sign in normally.

Users cannot choose a new password

If Password Policies are enabled, confirm that the chosen password satisfies the configured minimum strength for the user’s WordPress role.

The WordPress password strength indicator provides guidance while the new password is entered.

Users repeatedly see the password change screen

Confirm that the password change completed successfully.

If another plugin is modifying the standard WordPress password process, review whether both plugins are attempting to manage password changes simultaneously.

Privacy

Password Change Enforcement does not record or store user passwords.

Only password age information required to determine when a password was last changed is maintained.

All information remains on your website and is intended solely to support your chosen password management policy.

Continue with: