Linux 软件免费装

在这里免费安装WordPress以及其他软件

WP Modern Password Hashing

开发者 michaelrhmw
更新时间 2018年10月3日 07:18
PHP版本: 5.2.4 及以上
WordPress版本: 4.9.8
版权: GPLv2 or later
版权网址: 版权信息

标签

security authentication password algorithm hash bcrypt argon2 phpass

下载

详情介绍:

For legacy support with a wider range of PHP versions, Wordpress opts to use PHPASS (a portible password hashing library) which Wordpress defaults to using a MD5 based hash. The security of your password hashes can be improved by using a modern password hashing algorithm, such as BCRYPT for PHP 5.5+ or ARGON2I for PHP 7.2+ This plugin aims to improve the security of the hashed passwords by using PHP 5.5's password_hash() function and the BCRYPT algorithm but also supports the newer ARGON2I algorithm. For extended support when password_hash() is not available this plugin will fallback to using PHPASS with additional security when compared to the Wordpress defaults.

安装:

  1. Upload the plugin folder to the /wp-content/plugins directory, or install the plugin through the WordPress plugins screen directly.
  2. Activate the plugin through the 'Plugins' screen in WordPress.
  3. User passwords will be rehashed on the next successful login.

常见问题:

How do I use ARGON2I

Currently you will need to update the alorithm in 'wp-modern-password-hashing.php' line 18, from PASSWORD_BCRYPT to PASSWORD_ARGON2I Keep in mind that updates will undo your change, I plan to add an options screen to wp-admin.

How do I use BCRYPT

If PHP 5.5 or higher is used, then password_hash() will be available, and the plugin will default to using it.

Can I change between ARGON2I and BCRYPT?

Provided you change the alorithm in 'wp-modern-password-hashing.php' line 18. Keep in mind that updates will undo your change, I plan to add an options screen to wp-admin. Yes, you should be able to change back and forth (Provided your PHP version is suffcient), as the password will be checked against the password_verify and password_needs_rehash functions.

What about Legacy support?

In cases where password_hash() is not available, PHPASS as included with WordPress will be used, but with two adjustments. The rounds/iterations_count option and the use_md5/portable_hashes have been adjusted from the WordPress defaults of '8, true' to '16, false' This should improve the security of the hashed passwords, for those who are running on older versions of PHP.

更新日志:

1.0.1 1.0.0