Documentation / Weak Password List

Weak Password List

Overview

The weak password list feature checks every new password against a built-in list of over 100,000 commonly used weak passwords. If a user attempts to set a password that appears on this list, the password is rejected.

Enabling the Rule

1. Navigate to Settings → Login Security.
2. In the Enabled rules section, enable Check user’s passwords against the weaklist.
3. Click Save all settings.

When enabled, the plugin checks passwords during:

• Password changes on the User Profile page
• Password resets via the reset form
• New user registration
• Login (to detect non-compliant existing passwords)

How It Works

The plugin ships with a text file containing over 100,000 of the most commonly used passwords. When a user sets or changes their password, the plugin compares it against this list. If a match is found, the password is rejected and the user sees an error indicating the password does not comply with the password policy.

The list is read line by line to keep memory usage low, which helps limit the cost of checking large password lists.

Custom Weak Password Lists

Developers can extend the built-in list by providing additional passwords through the password_requirements__custom_password_weaklist filter. See Hooks and Filters for details.