Cypress North Password Policy
| 开发者 | cypressnorth |
|---|---|
| 更新时间 | 2026年9月1日 05:08 |
| PHP版本: | 8.1 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- A password rule engine that validates on user registration, password reset, and profile updates — covering minimum length, character requirements, breach-corpus check via the Have I Been Pwned k-anonymity API, denylist of common passwords, edit-distance check against the current password, and a per-user history check.
- Layered failed-login lockout: separate thresholds per IP and per username, with rolling windows and auto-release. Generic "invalid credentials" error responses so locked state is not disclosed to attackers.
- A soft-force interstitial that catches users at next login when their password is expired, breached, or below the active policy — they cannot escape without choosing a compliant new password.
- Daily email summary for administrators when attack rates spike.
- Per-user notification emails on password change, lockout, and expiration warnings.
- GDPR exporter + eraser that integrate with WordPress's built-in Personal Data tools.
- Audit log of every relevant event (login failures, lockouts, password changes, compliance state transitions) viewable in the admin.
- Cleanup cron that trims old failed-attempt rows on a configurable schedule.
- WP-CLI
wp cnpp unlockcommand to release a stuck IP or username without opening the admin. - Multisite-aware: super-admin can globally configure or delegate per-site management.
wp_hash_password) and never stores plaintext. The built-in zxcvbn strength meter is left intact. All integration is via documented WP filters and actions — deactivating the plugin removes its behavior cleanly.
安装:
- Upload the
cn-password-policyfolder to/wp-content/plugins/, or install via the WordPress plugin directory. - Activate the plugin through the Plugins menu in WordPress.
- Visit Settings → Password Policy to review the defaults and adjust thresholds, lockout windows, notification recipients, and trusted-proxy configuration.
屏幕截图:
常见问题:
Does this plugin store plaintext passwords?
No. WordPress core stores password hashes; this plugin stores additional one-way hashes of prior passwords for the password-history check, computed with the same wp_hash_password function core uses. No plaintext is persisted.
Does the HIBP breach check send my password over the network?
No. The Have I Been Pwned check uses k-anonymity: the plugin sends only the first five characters of the SHA-1 hash of the password to api.pwnedpasswords.com, and matches the returned suffix list locally. The plaintext never leaves your site. If the HIBP API is unreachable, the rule fails open so password changes are not blocked by an outage.
Does it replace WordPress's built-in zxcvbn strength meter?
No. WordPress's strength meter continues to work as before. This plugin enforces its rules at form submission rather than redrawing the meter.
Does it include two-factor authentication?
No. 2FA is a separate concern and is handled by purpose-built plugins. This plugin focuses strictly on password strength, lockout, and the surrounding compliance flows.
How does the lockout interact with the WordPress login form?
When a threshold is crossed, the user receives the same generic "invalid credentials" error that any other failed login produces — the locked state is deliberately not disclosed. Admins unlock locked IPs or usernames from Settings → Password Policy → Tools, or via WP-CLI.
Is there a WP-CLI command?
Yes, one: wp cnpp unlock --ip=<ip> and/or --user=<id-or-login> releases an active lockout and clears the failed-attempts counter for the supplied identifier. Both flags can be combined in one invocation. A broader CLI surface (stats, settings export, log query) is on the roadmap for a future release.
Does it support WooCommerce or BuddyPress checkout/registration flows?
Not in 1.0. Both plugins use their own registration and password-change paths that don't fire the core WordPress filters this plugin hooks into. Explicit integration is planned for 2.0.
How do I translate the plugin?
A POT template ships in languages/cn-password-policy.pot. Once the plugin is listed on WordPress.org, translations are accepted via translate.wordpress.org. The plugin declares Text Domain: cn-password-policy and Domain Path: /languages so WordPress's translation loader picks up .mo files automatically.
更新日志:
- Increment Wordpress Compatibility to 7.1.
- Initial release.
- NIST-aligned password rule engine with HIBP breach checking, denylist screening, edit-distance check, and per-user history.
- Layered failed-login lockout (per-IP and per-username) with rolling windows, auto-release, and admin-controlled manual unlock.
- Soft-force interstitial covering expired, breached, and below-policy passwords.
- Per-event notification dispatcher with daily attack-detection digest for admins.
- Audit log viewer.
- GDPR exporter and eraser integrated with WordPress core Privacy tools.
- Multisite super-admin gating with delegated per-site management toggle.
- Uninstall path that respects the admin's data-removal preference (default off — security plugins should not silently delete the audit trail).
wp cnpp unlockWP-CLI command.