Password Policies
Last updated: 10th July 2026 for CC Security Essentials Pro version 1.0
Introduction
Passwords remain one of the most important ways of protecting WordPress user accounts.
Even when Login Protection is enabled, weak or easily guessed passwords can leave administrator accounts vulnerable to compromise.
CC Security Essentials Pro allows you to define password strength requirements for different WordPress user roles, helping to ensure that accounts with greater privileges use appropriately strong passwords.
The feature is designed to support good security practices while remaining flexible enough for different types of website.
Why Password Policies Matter
Not every WordPress account has the same level of access.
An Administrator can make significant changes to the website, while a Subscriber may have little or no administrative capability.
Password Policies allow you to apply stronger requirements where they matter most.
For example:
- Administrator accounts might require Very Strong passwords.
- Editors might require Strong passwords.
- Subscribers might continue using the default WordPress password requirements.
This allows security requirements to reflect the level of access each role has.
How Password Policies Work
Each supported WordPress role can be assigned its own minimum password strength requirement.
When a user changes their password, WordPress evaluates the password using its built-in strength meter.
CC Security Essentials Pro then checks whether the calculated strength meets the minimum requirement configured for that user’s role.
If the password does not meet the required strength, it cannot be used.
Configuring Password Policies
Open:
Security → Password Policies
A table lists the supported WordPress roles together with the current minimum password requirement for each.
Each role can be configured independently.
Password Strength Levels
CC Security Essentials Pro provides four policy levels.
Default
Uses the standard WordPress password behaviour.
No additional minimum strength requirement is imposed.
This is suitable when you prefer WordPress to manage password strength without further restrictions.
Strong
Requires passwords that WordPress considers Strong.
This is appropriate for most administrator, editor and organisational accounts.
Very Strong
Requires the highest password strength recognised by WordPress.
This level is recommended for:
- Administrators
- Website owners
- Security administrators
- Other highly privileged accounts
Disabled
No additional password policy is enforced for that role.
This option is generally suitable only where password policies are managed by another system or where there is a specific operational reason not to enforce them.
Recommended Settings
For most websites we recommend:
| User Role | Suggested Policy |
|---|---|
| Administrator | Very Strong |
| Editor | Strong |
| Author | Strong |
| Contributor | Default |
| Subscriber | Default |
These recommendations provide a good balance between security and usability for many websites.
You should always consider the specific requirements of your own website.
Existing Passwords
Password Policies do not immediately invalidate existing passwords.
Instead, the policy is applied when a password is changed or when Password Change Enforcement requires a user to choose a new password.
This avoids unexpectedly preventing users from accessing their accounts immediately after enabling the feature.
Password Changes
Whenever a user creates or changes a password, the plugin checks whether it satisfies the configured policy.
If the required strength is met, the password can be saved normally.
If not, the user is asked to choose a stronger password.
The process uses WordPress’s built-in password strength evaluation to provide familiar and consistent feedback.
Working with Password Managers
Password managers are strongly recommended.
They make it practical for users to create and store long, unique passwords without needing to remember them.
When using a password manager, stronger password policies generally have little impact on usability while significantly improving account security.
Relationship with Other Features
Password Policies work alongside several other Pro features.
Login Protection
Login Protection helps reduce repeated password guessing.
Password Policies help ensure that successful guesses are much less likely.
Together they provide stronger protection than either feature alone.
Password Age Monitoring
Password Age Monitoring helps administrators identify passwords that may need replacing.
Password Policies ensure that replacement passwords meet the required strength.
Password Change Enforcement
When users are required to change their password, the new password must satisfy the configured policy for their role.
Best Practice
When using Password Policies we recommend:
- requiring stronger passwords for privileged accounts;
- encouraging the use of password managers;
- removing unused accounts;
- reviewing administrator accounts regularly;
- combining Password Policies with Login Protection.
Avoid requiring unnecessarily complex passwords for low-risk accounts unless your organisation has a specific policy requiring them.
Common Questions
Will existing users have to change their passwords immediately?
No.
Existing passwords remain valid until they are changed or until another feature, such as Password Change Enforcement, requires a new password.
Can different roles use different policies?
Yes.
Each supported WordPress role can have its own minimum password strength requirement.
Does the plugin replace the WordPress password system?
No.
CC Security Essentials Pro builds upon WordPress’s existing password handling and strength evaluation rather than replacing it.
Can users still generate passwords automatically?
Yes.
The standard WordPress password generator continues to work normally and is an excellent way of creating strong passwords.
Troubleshooting
Users cannot save a new password
Confirm that the chosen password meets the configured minimum strength for their role.
The WordPress password strength indicator provides immediate feedback as the password is entered.
The policy seems stricter than expected
Review the configured policy for the user’s WordPress role.
Remember that different roles may have different minimum requirements.
Another plugin also enforces password policies
Some security plugins include their own password policy features.
Running multiple password policy systems may produce confusing validation messages or conflicting requirements.
Review your active plugins and avoid enabling duplicate functionality where practical.
Related Articles
Continue with: