Today we’re publishing Teydea Login Security 3.9.0 (free) and 3.16.0 (PRO). The free plugin adds the last password change date to personal data exports and improves the “Current Password” field. PRO gives you control over what happens when the weak password list can’t be read, and Site Health now reports on that list.
Shared Updates (Free 3.9.0 & PRO 3.16.0)
- Last password change in personal data exports: Exports made from WordPress’s Export Personal Data tool now include a “Last password change” entry with the date the user last changed their password.
- Improved compatibility with plugins that change login cookies: The password check that runs when users sign in now works with plugins that change login cookies during sign-in.
- Current Password field on multisite: On multisite, the “Current Password” field on the user-admin profile screen is now checked.
- Fixed side effects of confirming the current password: A mistyped current password no longer counts as a failed login, and a correct one no longer resets the password age.
- A more accessible Current Password field: The field keeps its label visible, is recognized by password managers, and has its help text announced by screen readers.
- Works with strict Content-Security-Policy headers: The “Current Password” field is now positioned by an enqueued script, so it also works on sites whose Content-Security-Policy blocks inline scripts.
- Maintenance: Updated dependencies and general code improvements.
PRO-Only Updates (3.16.0)
- Weaklist screening setting: The weak password list rule now tells a list it cannot read apart from a password that is not on it. A new “Weaklist screening” choice on the General tab decides what happens then. By default the password is refused with a message asking the user to try again, and you can switch to fail-open to keep accepting passwords. Signing in and finishing a password reset are never refused because of an unreadable list.
- Weak password list in Site Health: Site Health now reports whether the plugin can read its weak password list. The report is marked critical while an active policy enables the rule.
- LifterLMS password resets: The LifterLMS password reset form is now treated as a required password change, so the minimum password age no longer blocks it.
- Pwned Passwords reachability check fixed: The check on the settings page and in Site Health no longer reports the Pwned Passwords API as unreachable when it is available. The breached-password check also now identifies itself to Have I Been Pwned as Teydea Login Security PRO.
- Safer plugin updates: The plugin updater now checks the update server’s response before offering an update, and offers none when the response is not valid.
- 4096-byte password limit for every user: Passwords longer than 4096 bytes are now refused for users no policy covers, as the free plugin already did.
- Role and user pickers: The role and user pickers in the policy settings no longer stop at ten entries on WordPress 6.6 to 7.0.
- Accessibility: Notices on the settings screens no longer interrupt screen reader announcements of your actions, and the Vendor defaults findings table now has row headers.
You can download the latest versions of the Teydea Login Security plugin directly from WordPress.org (Free version) or the Customer Portal (PRO version).
For questions and help about this release, please get in touch with our support team.