[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgbgZm93kpaF6sUAyiZKI9LT-F5MBjrggx8ayDnFELdY":3},{"slug":4,"name":5,"version":6,"author":7,"author_profile":8,"description":9,"short_description":10,"active_installs":11,"downloaded":12,"rating":13,"num_ratings":14,"last_updated":15,"tested_up_to":16,"requires_at_least":17,"requires_php":18,"tags":19,"homepage":24,"download_link":25,"security_score":26,"vuln_count":27,"unpatched_count":27,"last_vuln_date":28,"fetched_at":29,"vulnerabilities":30,"developer":31,"crawl_stats":28,"alternatives":38,"analysis":148,"fingerprints":198},"enforce-strong-password","Enforce Strong Password","1.3.5","Jan Štětina","https:\u002F\u002Fprofiles.wordpress.org\u002Fzaantar\u002F","\u003Cp>Forces all users to have a strong password when they’re changing it on their profile page. If user enters a weak password an error message is displayed.\u003C\u002Fp>\n\u003Cp>It uses the same algorithm to determine password strength as WordPress.\u003C\u002Fp>\n\u003Cp>On multisite, network administrator can define required password strength (Network Admin –> Settings –> Enforce Strong Passwords). On single site it’s admin has this capability (Options –> Enforce Strong Passwords).\u003C\u002Fp>\n\u003Cp>Developed for private use, but has perspective for more extensive usage. I can’t guarantee any support in the future nor further development, but it is to be expected. Kindly inform me about bugs, if you find any, or propose new features: \u003Ca href=\"mailto:zaantar@zaantar.eu?subject=[enforce-strong-password]\" rel=\"nofollow ugc\">zaantar@zaantar.eu\u003C\u002Fa>.\u003C\u002Fp>\n","Forces all users to have a strong password when they're changing it on their profile page.",100,7776,80,1,"2013-05-13T14:58:00.000Z","3.5.2","3.5.1","",[20,21,22,23],"enforce","force","password","strong","http:\u002F\u002Fwordpress.org\u002Fextend\u002Fplugins\u002Fenforce-strong-password","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fenforce-strong-password.1.3.5.zip",85,0,null,"2026-03-15T15:16:48.613Z",[],{"slug":32,"display_name":7,"profile_url":8,"plugin_count":33,"total_installs":34,"avg_security_score":35,"avg_patch_time_days":36,"trust_score":26,"computed_at":37},"zaantar",8,200,87,30,"2026-04-05T15:04:03.764Z",[39,61,80,105,128],{"slug":40,"name":41,"version":42,"author":43,"author_profile":44,"description":45,"short_description":46,"active_installs":11,"downloaded":47,"rating":13,"num_ratings":48,"last_updated":49,"tested_up_to":50,"requires_at_least":51,"requires_php":52,"tags":53,"homepage":59,"download_link":60,"security_score":11,"vuln_count":27,"unpatched_count":27,"last_vuln_date":28,"fetched_at":29},"password-reset-enforcement","Password Reset Enforcement","1.11.1","Teydea Studio","https:\u002F\u002Fprofiles.wordpress.org\u002Fteydeastudio\u002F","\u003Cp>\u003Cstrong>Enhance your WordPress website’s security by forcing users to reset their passwords.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Password Reset Enforcement is a simple yet powerful security plugin that allows site administrators to require users to update their passwords—ideal after a potential data breach, routine security checks, or during onboarding\u002Foffboarding processes.\u003C\u002Fp>\n\u003Ch3>Features\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Force password reset for all users\u003C\u002Fstrong>, specific user roles, or individual users.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Optional email notification\u003C\u002Fstrong> to users with a direct reset link.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Flexible login behavior\u003C\u002Fstrong>:\n\u003Cul>\n\u003Cli>\u003Cem>Allow login before resetting\u003C\u002Fem>: users log in with the old password, are immediately prompted to set a new one.\u003C\u002Fli>\n\u003Cli>\u003Cem>Block login until reset\u003C\u002Fem>: users must reset their password before accessing the dashboard.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Choose reset timing\u003C\u002Fstrong>:\n\u003Cul>\n\u003Cli>\u003Cem>Immediately\u003C\u002Fem>: forces logout and password reset on next login.\u003C\u002Fli>\n\u003Cli>\u003Cem>After session expiry\u003C\u002Fem>: users are asked to reset after their current session ends.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\u003Cstrong>WP-CLI support\u003C\u002Fstrong> for command-line password management and automation.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Multisite compatible\u003C\u002Fstrong> (network-wide reset only).\u003C\u002Fli>\n\u003Cli>Optimized for performance on large-scale and enterprise WordPress installations.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Use Cases\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>Responding to a \u003Cstrong>security breach\u003C\u002Fstrong> or suspected compromise.\u003C\u002Fli>\n\u003Cli>Enforcing \u003Cstrong>routine password changes\u003C\u002Fstrong> in corporate environments.\u003C\u002Fli>\n\u003Cli>Applying \u003Cstrong>onboarding\u002Foffboarding security policies\u003C\u002Fstrong> for teams or membership sites.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Compatibility\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>Works on both single-site and multisite (network) WordPress setups.\u003C\u002Fli>\n\u003Cli>Supports PHP 7.4+ and WordPress 6.6 through 6.8.\u003C\u002Fli>\n\u003Cli>Compatible with modern WordPress admin experience.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>WP-CLI Commands\u003C\u002Fh3>\n\u003Cp>This plugin provides WP-CLI commands for automated password reset management:\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Force Password Reset\u003C\u002Fstrong>\u003Cbr \u002F>\n    wp password-reset-enforcement force [–to_all] [–to_roles=] [–to_users=] [–applicability=] [–with_email] [–with_current_password_allowed] [–limit=] [–paged=]\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Clear Password Reset Enforcement\u003C\u002Fstrong>\u003Cbr \u002F>\n    wp password-reset-enforcement clear [–to_all] [–to_roles=] [–to_users=] [–limit=] [–paged=]\u003C\u002Fp>\n\u003Cp>\u003Cstrong>List Users with Enforced Password Reset\u003C\u002Fstrong>\u003Cbr \u002F>\n    wp password-reset-enforcement list [–limit=] [–paged=]\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Check Password Reset Status\u003C\u002Fstrong>\u003Cbr \u002F>\n    wp password-reset-enforcement status [–to_all] [–to_roles=] [–to_users=] [–limit=] [–paged=]\u003C\u002Fp>\n\u003Ch4>Command Options\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>\u003Ccode>--to_all\u003C\u002Fcode>: Target all users on the site\u003C\u002Fli>\n\u003Cli>\u003Ccode>--to_roles=\u003Croles>\u003C\u002Fcode>: Comma-separated list of user roles (e.g., editor,administrator)\u003C\u002Fli>\n\u003Cli>\u003Ccode>--to_users=\u003Cuser_ids>\u003C\u002Fcode>: Comma-separated list of specific user IDs (e.g., 1,5,10)\u003C\u002Fli>\n\u003Cli>\u003Ccode>--applicability=\u003Cwhen>\u003C\u002Fcode>: When reset takes effect (immediately, after_session_expiry)\u003C\u002Fli>\n\u003Cli>\u003Ccode>--with_email\u003C\u002Fcode>: Send email notifications to affected users (default: true)\u003C\u002Fli>\n\u003Cli>\u003Ccode>--with_current_password_allowed\u003C\u002Fcode>: Allow users to reuse current password (default: false)\u003C\u002Fli>\n\u003Cli>\u003Ccode>--limit=\u003Cnumber>\u003C\u002Fcode>: Maximum users to process in single operation\u003C\u002Fli>\n\u003Cli>\u003Ccode>--paged=\u003Cpage>\u003C\u002Fcode>: Page number for pagination\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch4>Command Examples\u003C\u002Fh4>\n\u003Cpre>\u003Ccode>wp password-reset-enforcement force --to_all\nwp password-reset-enforcement force --to_roles=editor,administrator --applicability=after_session_expiry\nwp password-reset-enforcement clear --to_users=1,5,10\nwp password-reset-enforcement list --limit=50 --paged=2\nwp password-reset-enforcement status --to_all --limit=50 --paged=2\u003Ch3>Related Plugins\u003C\u002Fh3>\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Want to go beyond forced password resets? Check our \u003Ca href=\"https:\u002F\u002Fwppasswordpolicy.com\u002F?utm_source=Password+Reset+Enforcement\" rel=\"nofollow ugc\">WP Password Policy\u003C\u002Fa> plugin to enforce strong password rules, block weak passwords, and set automatic expiry policies — so you’ll never need to force a password reset again. [https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fpassword-requirements\u002F](Free version available on WordPress.org).\u003C\u002Fp>\n","Easily enforce password reset for WordPress users. Choose to force password changes site-wide, by user and\u002For by role, to boost your site's security.",3589,2,"2025-11-28T14:31:00.000Z","6.9.4","6.6","7.4",[54,55,56,57,58],"force-password-change","password-enforcement","reset-password","secure-login","wordpress-security","https:\u002F\u002Fteydeastudio.com\u002F?utm_source=Password+Reset+Enforcement","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fpassword-reset-enforcement.1.11.1.zip",{"slug":62,"name":63,"version":64,"author":65,"author_profile":66,"description":67,"short_description":68,"active_installs":27,"downloaded":69,"rating":11,"num_ratings":14,"last_updated":70,"tested_up_to":71,"requires_at_least":72,"requires_php":52,"tags":73,"homepage":18,"download_link":79,"security_score":11,"vuln_count":27,"unpatched_count":27,"last_vuln_date":28,"fetched_at":29},"safety-passwords","Safety Passwords","1.4.2","iTRON","https:\u002F\u002Fprofiles.wordpress.org\u002Fhokku\u002F","\u003Cp>This plugin enforces users to use strong passwords. It means that when a user changes his password, the password must contain at least:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>one uppercase letter;\u003C\u002Fli>\n\u003Cli>one lowercase letter;\u003C\u002Fli>\n\u003Cli>one number;\u003C\u002Fli>\n\u003Cli>\n\u003Cp>one special character\u003C\u002Fp>\n\u003Cp>and should be never used before.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>The minimum length of the password is defined by the plugin’s settings.\u003C\u002Fp>\n\u003Cp>You can also define the period of time after which the user will be forced to change his password.\u003C\u002Fp>\n\u003Cp>The important feature of the plugin is settings defining by means of PHP constants.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ccode>SAFETY_PASSWORDS_MIN_LENGTH\u003C\u002Fcode> – (int\u002Fstring, number of symbols) the minimum length of the password;\u003C\u002Fli>\n\u003Cli>\u003Ccode>SAFETY_PASSWORDS_RESET_INTERVAL\u003C\u002Fcode> – (int\u002Fstring, days) the period of time after which the user will be forced to change his password;\u003C\u002Fli>\n\u003Cli>\u003Ccode>SAFETY_PASSWORDS_RP_ON_REGISTRATION\u003C\u002Fcode> – (bool) whether enforce users to change their password after registration or not.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Integrations with other plugins:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>The plugin has integration with the Stream plugin.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Plugin development is on the \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fhokoo\u002Fsafety-passwords\" rel=\"nofollow ugc\">GitHub\u003C\u002Fa>.\u003C\u002Fp>\n","Enforce users to use strong passwords.",2168,"2025-04-27T16:55:00.000Z","6.8.5","5.0",[74,75,76,77,78],"enforce-secure-passwords","force-secure-passwords","secure-password-validation","secure-passwords","user-passwords","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsafety-passwords.1.4.2.zip",{"slug":81,"name":82,"version":83,"author":84,"author_profile":85,"description":86,"short_description":87,"active_installs":88,"downloaded":89,"rating":90,"num_ratings":91,"last_updated":92,"tested_up_to":50,"requires_at_least":93,"requires_php":52,"tags":94,"homepage":100,"download_link":101,"security_score":102,"vuln_count":103,"unpatched_count":27,"last_vuln_date":104,"fetched_at":29},"better-wp-security","Solid Security – Password, Two Factor Authentication, and Brute Force Protection","9.4.6","StellarWP","https:\u002F\u002Fprofiles.wordpress.org\u002Fstellarwp\u002F","\u003Ch4>Reduce your WordPress website’s risk to nearly zero with Solid Security\u003C\u002Fh4>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fgo.solidwp.com\u002Fwporg-security-ithemes\" rel=\"nofollow ugc\">Formerly iThemes Security. Looking for iThemes? Learn more here.\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>On average, 30,000 websites are hacked every day.* Cyberattacks in the US increased by 57% in 2022.** Bad actors who want to hack your site, steal your data, and cripple your business are a 24\u002F7\u002F365 threat.\u003C\u002Fp>\n\u003Cp>You need a proactive, strategic approach to WordPress website security that protects your site from brute force attacks, malware infections, and other cyber threats.\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fgo.solidwp.com\u002Fsolid-security-pro\" rel=\"nofollow ugc\">Solid Security\u003C\u002Fa> shields your site from cyberattacks and prevents security vulnerabilities. It automatically locks out bad users identified by our Brute Force Protection Network that is nearly 1 million sites strong and leverages your own blacklist. It secures and protects your most commonly attacked part of your WordPress website – user login authentication.\u003C\u002Fp>\n\u003Cp>With Patchstack integration (Pro) protects your site before you even have a chance to address vulnerabilities and before a plugin or theme vendor or developer can even issue a patch.\u003C\u002Fp>\n\u003Cp>That’s 24\u002F7\u002F365 always-on truly Solid Security.\u003C\u002Fp>\n\u003Cp>\u003Ciframe loading=\"lazy\" title=\"Welcome to Solid Security, Part of the SolidWP Suite\" src=\"https:\u002F\u002Fplayer.vimeo.com\u002Fvideo\u002F863249227?dnt=1&app_id=122963\" width=\"750\" height=\"422\" frameborder=\"0\" allow=\"autoplay; fullscreen; picture-in-picture; clipboard-write\">\u003C\u002Fiframe>\u003C\u002Fp>\n\u003Ch4>🌐 Secure your Website in Minutes\u003C\u002Fh4>\n\u003Cp>The Solid Security setup and onboarding experience allows anyone to secure their WordPress website in under 10 minutes, regardless of technical acumen. Knowing that you have enabled all the right security settings for your website will leave you feeling like your site has never been more secure.\u003C\u002Fp>\n\u003Ch4>📚 Security Site Templates to Fit Your Type of Site\u003C\u002Fh4>\n\u003Cp>Enabling the correct security settings based on the type of website you are building or maintaining is essential for proper security. An eCommerce site requires a different level of security than a basic blog. Solid Security Site Templates make it quick and easy to apply the right security settings for your website.\u003C\u002Fp>\n\u003Cp>Choose from six different site templates to apply the type of security your site needs:\u003C\u002Fp>\n\u003Col>\n\u003Cli>\u003Cstrong>Ecommerce\u003C\u002Fstrong> – websites that sell products or services\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Network\u003C\u002Fstrong> – websites that connect people or communities\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Non-Profit\u003C\u002Fstrong> – websites that promote your cause and collect donations\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Blog\u003C\u002Fstrong> – websites that share your thoughts or start a conversation\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Portfolio\u003C\u002Fstrong> – websites that showcase your craft\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Brochure\u003C\u002Fstrong> – simple websites that promote your business\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch4>⌚ Real-Time Website Security Dashboard\u003C\u002Fh4>\n\u003Cp>Every day, lots of activity is happening on your website that you can’t see. Many of these activities can be related to your site’s security, so monitoring these events is vital to keeping your site secure.\u003C\u002Fp>\n\u003Cp>The \u003Ca href=\"https:\u002F\u002Fgo.solidwp.com\u002Fsolid-security-pro\" rel=\"nofollow ugc\">Solid Security Pro\u003C\u002Fa> plugin provides a real-time WordPress security dashboard that monitors security-related events on your site around the clock. The Solid Security Dashboard is a dynamic dashboard with all your WordPress website’s security activity stats in one place, including brute force attacks, banned users, active lockouts, site scan results, and user security stats (Pro).\u003C\u002Fp>\n\u003Ch4>🗝️ WordPress Login Security\u003C\u002Fh4>\n\u003Cp>Setting up and maintaining proper WordPress configurations and managing user account access are essential aspects of hardening your site against threats and vulnerabilities. Basic and Pro include features that address both of these factors.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\n\u003Cp>\u003Cstrong>Two Factor Authentication (2FA)\u003C\u002Fstrong> – Make your WordPress login nearly impenetrable to attack by requiring users to enter a security code along with a password to login. The Solid Security plugin allows you to add two-factor authentication to your WordPress login with several authentication methods, including mobile apps like Authy and Google Authenticator, email, and backup codes.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>Password Requirements\u003C\u002Fstrong> – Create and enforce a password policy for your users in less than a minute.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>reCAPTCHA\u003C\u002Fstrong> (Pro) – Stop bad bots from engaging in abusive activities on your website, such as attempting to break into your website using compromised passwords, posting spam, or even scraping your content.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>Passwordless Logins\u003C\u002Fstrong> (Pro) – WordPress security made easy. Secure your user accounts with 2fa & strong passwords while allowing real users login with a click of a mouse.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>Trusted Devices\u003C\u002Fstrong> (Pro) – Identify the devices you and other users use to block session hijacking attacks and limit Administrator privileges to Trusted Devices.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>Automated Vulnerability Patching\u003C\u002Fstrong> (Pro) – Solid Security Pro includes Patchstack which patches vulnerabilities before you have a chance to and applies fixes even before a plugin developer or vendor has issued a patch.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Learn more about how \u003Ca href=\"https:\u002F\u002Fgo.solidwp.com\u002Fwporgpasswordless\" rel=\"nofollow ugc\">passwordless login is the future\u003C\u002Fa> and how Solid Security can help you implement it today.\u003C\u002Fp>\n\u003Ch4>👨‍👩‍👧‍👦 The Right Amount of Security for Every User Level\u003C\u002Fh4>\n\u003Cp>Different types of user levels require different levels of security. During the Solid Security setup process, you can identify your website’s key user groups. Once the different types of users are identified, you can apply the level of security that is just right for each user group.\u003C\u002Fp>\n\u003Cp>Here are a couple of examples of how User Groups are useful for securing your site:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\n\u003Cp>\u003Cstrong>For Clients\u003C\u002Fstrong> – Let’s say you are configuring Solid Security on a client’s website. You will decide whether or not they are required to use two-factor authentication and if they should have access to the Solid Security settings.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>For Customers\u003C\u002Fstrong> – If you have an eCommerce website, you will decide whether or not you want to protect customer accounts with a password policy.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Privilege Escalation\u003C\u002Fstrong> (Pro) also adds a safe, secure way to grant temporary admin-level access to your website.\u003C\u002Fp>\n\u003Ch4>🤖 Block Bad Bots & Ban User Agents with Lockouts\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>\n\u003Cp>\u003Cstrong>Ban Users\u003C\u002Fstrong> (Basic and Pro) – Permanently block repeat offenders from accessing your site.\u003Cbr \u002F>\nLocal Brute Force Protection – Automatically identify and stop the most common method of attack on WordPress sites.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>Local Brute Force Protection\u003C\u002Fstrong> (Basic and Pro) – Automatically identify and stop the most common method of attack on WordPress sites.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>Network Brute Force Protection\u003C\u002Fstrong> (Basic and Pro) – The network is the Solid Security community and is nearly one million websites strong. If someone tries to break into websites in the Solid Security community, Solid Security will block them across the network.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>Magic Links\u003C\u002Fstrong> (Pro) – Security shouldn’t get in your way. Magic Links allow you to log in to your WordPress site while your username is locked out by the Solid Security Local Brute Force Protection feature.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch4>🔍 Monitor Your Site’s Security Health\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>\n\u003Cp>\u003Cstrong>File Change Detection\u003C\u002Fstrong> (Basic and Pro) – Solid Security logs changes made to your website that can help detect malicious activity on your website.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>Site Scanner (Basic and Pro)\u003C\u002Fstrong> – Schedule checks to run four times per day (Basic) or hourly (Pro) for known vulnerabilities of WordPress core file, plugins and themes. Using the Google Safe Browsing API, the Site Scan also checks your Google’s blocklist status and will alert you if Google has found any malware on your website.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>Patchstack integration (Pro)\u003C\u002Fstrong> – Automated virtual patching of some vulnerabilities before you even have a chance to address them yourself, and before a plugin or theme vendor or developer can even issue a patch.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>Site Scanner\u003C\u002Fstrong> (Pro) – Unlock Version Management to automatically apply a patch to vulnerable software detected by the Site Scan when one is available.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>User Logging\u003C\u002Fstrong> (Pro) – Keep a record of user activity in your WordPress security logs, including login\u002Flogout, user registration, adding\u002Fremoving plugins, switching themes, changes to posts and pages, and more.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>Version Management\u003C\u002Fstrong> (Pro) – The Version Management feature in Solid Security Pro allows you to auto-update WordPress, plugins, and themes. Beyond that, Version Management also has options to harden your website when you are running outdated software and scan for old websites.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch4>🧠 Smarter, More Actionable Vulnerability Prioritization\u003C\u002Fh4>\n\u003Cp>Not all vulnerabilities pose the same level of risk, and the traditional Common Vulnerability Scoring System (CVSS) score doesn’t always reflect the realities of running a WordPress site.\u003C\u002Fp>\n\u003Cp>Solid Security now uses the Patchstack Priority score, which goes beyond CVSS to provide a real-world risk assessment tailored to WordPress. It factors in how likely a vulnerability is to be exploited and its actual impact on your site.\u003C\u002Fp>\n\u003Cp>With Patchstack Priority, you get a clearer picture of what really matters, helping you focus on the vulnerabilities that pose the greatest risk, and worry less about noise from low-impact issues.\u003C\u002Fp>\n\u003Ch4>🛠️ Website Security Utilities\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>\n\u003Cp>\u003Cstrong>Enforce SSL\u003C\u002Fstrong> – Force all connections to the website to be made over SSL\u002FTLS.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>Database Backups\u003C\u002Fstrong> – Create backups of your WordPress database. (Not a complete backup.)\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>Geolocation\u003C\u002Fstrong> (Pro) – Improve Trusted Devices by connecting to an external location or mapping API.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch4>🚀 Advanced Security Tools\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>\u003Cstrong>Identify Server IPs\u003C\u002Fstrong> – Prevent issues caused by inadvertently locking out your server IPs.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Change User ID 1\u003C\u002Fstrong> – Change the user ID for the first WordPress user, potentially preventing attacks that assume the user with ID1 exists and is an administrator.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Change Database Prefix\u003C\u002Fstrong> – Change the database prefix that WordPress uses, potentially preventing attacks that assume the database prefix is “wp_”.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Check File Permission\u003C\u002Fstrong> – See the file and directory permissions of key areas of your site.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Server Config Rules\u003C\u002Fstrong> – View or flush the server security rules generated by Solid Security.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>wp-config.php Rules\u003C\u002Fstrong> – View or flush the wp-config.php security rules generated by Solid Security.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Change WordPress Salts\u003C\u002Fstrong> – Secure your site after a successful attack by changing the WordPress salts used to secure cookies and security tokens.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Hide Login URL\u003C\u002Fstrong> – change the login URL of your site, making it harder for bots to find your login page and attack it.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch4>🛟 Need Help?\u003C\u002Fh4>\n\u003Cp>Free support may be available with the community’s help in the WordPress.org support forums. Our Solid Security support team provides top-notch technical support to all our Solid Security Basic users there.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>\u003Ca href=\"https:\u002F\u002Fgo.solidwp.com\u002Fsecurity-help-center\" rel=\"nofollow ugc\">Our Help Center will help you become an iThemes Security expert.\u003C\u002Fa>\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Get additional peace of mind with professional support from our expert team and pro features to take your site’s security to the next level with Solid Security Pro.\u003C\u002Fp>\n\u003Ch4>Recover From a Hacked Site\u003C\u002Fh4>\n\u003Cp>Solid Security makes regular backups of your WordPress database, allowing you to get back online quickly in the event of a hack or security breach. Use Solid Security to create and email database backups on a customizable schedule.\u003C\u002Fp>\n\u003Cp>For complete site backups and the ability to restore or move WordPress to a new host or domain, check out \u003Ca href=\"https:\u002F\u002Fgo.solidwp.com\u002Fsecurity-basic-solid-backups\" rel=\"nofollow ugc\">Solid Backups\u003C\u002Fa>.\u003C\u002Fp>\n\u003Ch4>Solid Central Integration\u003C\u002Fh4>\n\u003Cp>Manage more than one WordPress site? Release lockouts and keep your themes, plugins, and WordPress core up to date from one dashboard with \u003Ca href=\"https:\u002F\u002Fgo.solidwp.com\u002Fsecurity-basic-solid-central\" rel=\"nofollow ugc\">Solid Central\u003C\u002Fa>.\u003C\u002Fp>\n\u003Cp>*Zippia. “30 Crucial Cybersecurity Statistics [2023]: Data, Trends And More” Zippia.com. Jun. 15, 2023, https:\u002F\u002Fwww.zippia.com\u002Fadvice\u002Fcybersecurity-statistics\u002F\u003C\u002Fp>\n\u003Cp>**https:\u002F\u002Fblog.checkpoint.com\u002F2023\u002F01\u002F05\u002F38-increase-in-2022-global-cyberattacks\u002F\u003C\u002Fp>\n\u003Ch3>License\u003C\u002Fh3>\n\u003Cp>Released under the terms of the GNU General Public License.\u003C\u002Fp>\n","Harden your site security with Login Security, Two-Factor Authentication (2FA), Vulnerability Scanner, Firewall, and more. Formerly iThemes Security.",700000,37290141,92,3981,"2026-02-25T12:43:00.000Z","6.5",[95,96,97,98,99],"brute-force-protection","malware","password-protection","security","two-factor-authentication","https:\u002F\u002Fsolidwp.com\u002Fproducts\u002Fsecurity","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fbetter-wp-security.9.4.6.zip",93,19,"2024-06-20 00:00:00",{"slug":106,"name":107,"version":108,"author":109,"author_profile":110,"description":111,"short_description":112,"active_installs":113,"downloaded":114,"rating":115,"num_ratings":116,"last_updated":117,"tested_up_to":71,"requires_at_least":118,"requires_php":119,"tags":120,"homepage":18,"download_link":125,"security_score":126,"vuln_count":48,"unpatched_count":27,"last_vuln_date":127,"fetched_at":29},"password-policy-manager","Password Policy Manager | Password Manager","2.0.6","miniOrange","https:\u002F\u002Fprofiles.wordpress.org\u002Fcyberlord92\u002F","\u003Cp>\u003Ca href=\"https:\u002F\u002Fplugins.miniorange.com\u002Fpassword-policy-manager\" rel=\"nofollow ugc\">Features\u003C\u002Fa> | \u003Ca href=\"https:\u002F\u002Fplugins.miniorange.com\u002Fsetup-password-policy-manager-to-enforce-wordpress-password-security\" rel=\"nofollow ugc\">Setup Guide\u003C\u002Fa> | \u003Ca href=\"https:\u002F\u002Fplugins.miniorange.com\u002Fpassword-policy-manager#free-demo\" rel=\"nofollow ugc\">Documentation\u003C\u002Fa>\u003C\u002Fp>\n\u003Ch3>Enforce Strong and Secure Password Policies with Password Policy Manager\u003C\u002Fh3>\n\u003Cp>The miniOrange \u003Cstrong>Password Policy Manager\u003C\u002Fstrong> plugin helps you enforce strong and secure password policies with features like \u003Cstrong>password reset\u003C\u002Fstrong>, \u003Cstrong>password expiry\u003C\u002Fstrong>, \u003Cstrong>password score\u003C\u002Fstrong>, and \u003Cstrong>strong password rules\u003C\u002Fstrong>.\u003C\u002Fp>\n\u003Cp>You can manage user passwords efficiently using the user password manager, password strength meter, and history manager to enhance overall password security.\u003Cbr \u002F>\nIn case of a breach, take quick action with one-click password reset, lock inactive users, and enforce random password rules.\u003C\u002Fp>\n\u003Cp>This ensures complete protection by securing passwords, and managing both active and lock inactive users to prevent password-based attacks.\u003Cbr \u002F>\nHave questions? Reach us at \u003Cstrong>mfasupport@xecurify.com\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Ch3>What is the Password Policy Manager Plugin for WordPress?\u003C\u002Fh3>\n\u003Cp>WordPress plugin for password expiry, strength check, and secure policy enforcement. Easy to install and configure, this Password Security plugin secures your site without disrupting the user experience.\u003C\u002Fp>\n\u003Cspan class=\"embed-youtube\" style=\"text-align:center; display: block;\">\u003Ciframe loading=\"lazy\" class=\"youtube-player\" width=\"750\" height=\"422\" src=\"https:\u002F\u002Fwww.youtube.com\u002Fembed\u002FZnwEDbedz1A?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent\" allowfullscreen=\"true\" style=\"border:0;\" sandbox=\"allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox\">\u003C\u002Fiframe>\u003C\u002Fspan>\n\u003Ch3>WordPress PPM Key Features (Free Version)\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Enforce strong passwords:\u003C\u002Fstrong> Force all users to create strong passwords according to the password policy set by the admin for high Password Security.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>\u003Ca href=\"https:\u002F\u002Fplugins.miniorange.com\u002Fhow-to-setup-password-policy-setting-wordpress-password-policy-plugin\" rel=\"nofollow ugc\">Users password manager:\u003C\u002Fa>\u003C\u002Fstrong> User password manager allows the admin to manage the users’ passwords (like password strength, how many passwords are strong, etc) to check the Password Security. [password policy setup guide]\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Enforce password change:\u003C\u002Fstrong> Administrators can force users to change their password on their next login using this functionality use to enforce strong passwords on their users and ensure strong Password Security.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>\u003Ca href=\"https:\u002F\u002Fplugins.miniorange.com\u002Fhow-to-set-one-click-reset-password-setting-wordpress-password-policy-plugin\" rel=\"nofollow ugc\">One click reset password:\u003C\u002Fa>\u003C\u002Fstrong> This feature allows the admin to invalidate the current password and force their users to generate a new strong password. This can be done for all users in case of any breach. This will kill all the current sessions and users will be forced to set a new strong password via email hence reinforcing the Password Security.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>\u003Ca href=\"http:\u002F\u002Fplugins.miniorange.com\u002Fhow-to-set-password-score-or-password-strength-checker-password-policy\" rel=\"nofollow ugc\">Password Score:\u003C\u002Fa>\u003C\u002Fstrong> It will show all the users’ password strengths. You can check whether the passwords being used are strong, medium or weak. Based on that you can use the enforce strong passwords feature to improve Password Security.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>\u003Ca href=\"https:\u002F\u002Fplugins.miniorange.com\u002Fhow-to-setup-password-expiry-time-wordpress-password-policy-plugin\" rel=\"nofollow ugc\">Auto Password Expiry:\u003C\u002Fa>\u003C\u002Fstrong> This feature allows the admin to enforce a custom time-based password expiry to improve Password Security. Once the password has expired, the users will be forced to create a new password.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Password strength:\u003C\u002Fstrong> The admin can set the minimum and maximum length of the password. You can also add constraints that you want your users to follow while setting a strong password.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Unlimited Users:\u003C\u002Fstrong> There is no user limit on the password policy manager plugin and it can be used to create password policies for unlimited users.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Which Key Features does Password Policy Manager support in the Enterprise Plan?\u003C\u002Fh3>\n\u003Col>\n\u003Cli>\u003Cstrong>Role-Based Enforce Strong Password on First Login:\u003C\u002Fstrong> Force specific users roles to create strong passwords according to the password policy set by the admin on their first login.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>User-Based One-click password Reset and Logout:\u003C\u002Fstrong> Admin can reset passwords of users at once and terminate their logged-in sessions with just one click in case of any suspicious activity using the One-click reset password. Admin can then send password reset links over email.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Custom Redirect URL:\u003C\u002Fstrong> The admin can redirect their users to a different \u003Ca href=\"https:\u002F\u002Fplugins.miniorange.com\u002Fhow-to-set-custom-redirect-url-password-policy-manager-on-wordpress\" rel=\"nofollow ugc\">custom URL\u003C\u002Fa> using this functionality.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Active & Inactive Users Activity Log:\u003C\u002Fstrong> The admin can track the activity of all active as well as lock inactive users using this tool of the Password Policy Enterprise plan.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Logout Inactive Users:\u003C\u002Fstrong> When this setting is enabled, a user is logged out and their session is destroyed if they are inactive for more than the customizable set time limit.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Multisite:\u003C\u002Fstrong> The Password Policy Manager Enterprise plugin is multisite compatible and can be used to create password policies for an entire multisite network.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Cp>For any customization-related queries, reach us at mfasupport@xecurify.com or call us at +1 9786589387.\u003C\u002Fp>\n\u003Ch3>Upgrade to miniOrange Password Policy Manager Premium Plan for Advanced Security\u003C\u002Fh3>\n\u003Cp>The premium plan of miniOrange WordPress Password Policy Manager gives you complete control over how users can secure passwords, helping you enforce policies across all roles, customize the login experience, and secure even the most complex WordPress setups.\u003C\u002Fp>\n\u003Cp>With the premium \u003Cstrong>Password Policy Manager\u003C\u002Fstrong> plugin offers advanced \u003Cstrong>password security features\u003C\u002Fstrong>, including role-based and user-based password policies. It also supports custom login forms like WooCommerce, Elementor, Ultimate Member, and more.\u003C\u002Fp>\n\u003Ch4>Premium Features List\u003C\u002Fh4>\n\u003Cblockquote>\n\u003Cul>\n\u003Cli>\u003Cstrong>\u003Ca href=\"https:\u002F\u002Fplugins.miniorange.com\u002Fhow-to-set-password-policy-role-based\" rel=\"nofollow ugc\">Role-Based and User-Based Password Policies:\u003C\u002Fa>\u003C\u002Fstrong> Admin can set different [role-based as well as user-based policies] and enforce password policy changes to ensure strong Password Security.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>User-Based Enforce Strong Password on First Login:\u003C\u002Fstrong> Force a specific set of users to create strong passwords according to the password policy set by the admin on their first login to maintain strong Password Security. \u003C\u002Fli>\n\u003Cli>\u003Cstrong>Role-Based Enforce Password Change:\u003C\u002Fstrong> Administrators can enforce specific sets of roles to change their passwords on their next login using this configuration to enhance Password Security.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>\u003Ca href=\"https:\u002F\u002Fplugins.miniorange.com\u002Fhow-to-set-one-click-reset-password-policy-role-based\" rel=\"nofollow ugc\">Role-Based One-click password Reset and Logout:\u003C\u002Fa>\u003C\u002Fstrong> Using [one-click reset password])  feature, the admin can reset passwords of all users \u002F particular roles at once and terminate all logged-in sessions with just one click in case of any suspicious activity. Admin can then send the password reset link over email.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>\u003Ca href=\"https:\u002F\u002Fplugins.miniorange.com\u002Fhow-to-generate-random-password\" rel=\"nofollow ugc\">Generate Random Passwords:\u003C\u002Fa>\u003C\u002Fstrong> Generate random passwords generates a random strong password containing all variations to make the password security strong and secure against brute force attacks.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>\u003Ca href=\"https:\u002F\u002Fplugins.miniorange.com\u002Fhow-to-apply-automatically-lock-inactive-user\" rel=\"nofollow ugc\">Automatically Lock Inactive Users:\u003C\u002Fa>\u003C\u002Fstrong> It will lock the user automatically if the user is inactive for the custom-specified time period. This can be set for particular roles as well as users.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>\u003Ca href=\"https:\u002F\u002Fplugins.miniorange.com\u002Fhow-to-set-password-history-management\" rel=\"nofollow ugc\">Password History Manager:\u003C\u002Fa>\u003C\u002Fstrong> It will manage the history of all the recently used passwords for each user, so no user can reuse a previous password.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Active Users Activity Log:\u003C\u002Fstrong> The admin can track the activity of all Active Users using this setting of the Password Policy Premium plan.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Custom Login Forms Supported:\u003C\u002Fstrong>  The Premium plan also supports the following custom login forms: WooCommerce, Ultimate Member, Elementor Pro, BBPress, Gravity Forms, Ninja Forms, Buddy Press, User Registration, User Pro, MemberPress, and many others.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Single Site:\u003C\u002Fstrong> The Password Policy Manager Premium plugin is single-site compatible and can be used to create password policies on only one site at a time.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fblockquote>\n\u003Ch3>Why You Need to Register with miniOrange\u003C\u002Fh3>\n\u003Cp>Some advanced features in the \u003Cstrong>Password Policy Manager\u003C\u002Fstrong> plugin, like one-click password reset and random password generation.\u003Cbr \u002F>\nCore functionalities such as enforcing strong password policies, password expiry, password history, and locking inactive users work without registration.\u003C\u002Fp>\n\u003Cp>Customized solutions and active support for the miniOrange Password Policy Manager plugin are available. Email us at mfasupport@xecurify.com or call us at +1 9786589387.\u003C\u002Fp>\n","Enforce strong passwords with expiry, reset, score checks, inactive user lock, and user password management using Password Policy Manager.",6000,93974,88,14,"2025-10-20T08:18:00.000Z","4.6","5.3.0",[121,122,56,123,124],"password-security","password-strength","secure-password","strong-password","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fpassword-policy-manager.2.0.6.zip",96,"2025-10-24 18:09:09",{"slug":129,"name":130,"version":131,"author":132,"author_profile":133,"description":134,"short_description":135,"active_installs":136,"downloaded":137,"rating":115,"num_ratings":138,"last_updated":139,"tested_up_to":140,"requires_at_least":141,"requires_php":18,"tags":142,"homepage":146,"download_link":147,"security_score":26,"vuln_count":27,"unpatched_count":27,"last_vuln_date":28,"fetched_at":29},"login-security-solution","Login Security Solution","0.56.0","Daniel Convissor","https:\u002F\u002Fprofiles.wordpress.org\u002Fconvissor\u002F","\u003Cp>A simple way to lock down login security for multisite and regular\u003Cbr \u002F>\nWordPress installations.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\n\u003Cp>Blocks brute force and dictionary attacks without inconveniencing\u003Cbr \u002F>\nlegitimate users or administrators\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Tracks IP addresses, usernames, and passwords\u003C\u002Fli>\n\u003Cli>Monitors logins made by form submissions, XML-RPC requests and\u003Cbr \u002F>\nauth cookies\u003C\u002Fli>\n\u003Cli>If a login failure uses data matching a past failure, the plugin\u003Cbr \u002F>\nslows down response times.  The more failures, the longer the delay.\u003Cbr \u002F>\nThis limits attackers ability to effectively probe your site,\u003Cbr \u002F>\nso they’ll give up and go find an easier target.\u003C\u002Fli>\n\u003Cli>If an account seems breached, the “user” is immediately logged out\u003Cbr \u002F>\nand forced to use WordPress’ password reset utility.  This prevents\u003Cbr \u002F>\nany damage from being done and verifies the user’s identity.  But\u003Cbr \u002F>\nif the user is coming in from an IP address they have used in the\u003Cbr \u002F>\npast, an email is sent to the user making sure it was them logging in.\u003Cbr \u002F>\nAll without intervention by an administrator.\u003C\u002Fli>\n\u003Cli>Can notify the administrator of attacks and breaches\u003C\u002Fli>\n\u003Cli>Supports IPv6\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>Thoroughly examines and enforces password strength.  Includes full\u003Cbr \u002F>\nUTF-8 character set support if PHP’s \u003Ccode>mbstring\u003C\u002Fcode> extension is enabled.\u003Cbr \u002F>\nThe tests have caught every password dictionary entry I’ve tried.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Minimum length (customizable)\u003C\u002Fli>\n\u003Cli>Doesn’t match blog info\u003C\u002Fli>\n\u003Cli>Doesn’t match user data\u003C\u002Fli>\n\u003Cli>Must either have numbers, punctuation, upper and lower case characters\u003Cbr \u002F>\nor be very long.  Note: alphabets with only one case (e.g. Arabic,\u003Cbr \u002F>\nHebrew, etc.) are automatically exempted from the upper\u002Flower case\u003Cbr \u002F>\nrequirement.\u003C\u002Fli>\n\u003Cli>Non-sequential codepoints\u003C\u002Fli>\n\u003Cli>Non-sequential keystrokes (custom sequence files can be added)\u003C\u002Fli>\n\u003Cli>Not in the password dictionary files you’ve provided (if any)\u003C\u002Fli>\n\u003Cli>Decodes “leet” speak\u003C\u002Fli>\n\u003Cli>The password\u002Fphrase is not found by the \u003Ccode>dict\u003C\u002Fcode> dictionary\u003Cbr \u002F>\nprogram (if available)\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>Blocks discovering user names via the “?author=” query string\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>Password aging (optional) (not recommended)\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Users need to change password every x days (customizable)\u003C\u002Fli>\n\u003Cli>Grace period for picking a new password (customizable)\u003C\u002Fli>\n\u003Cli>Remembers old passwords (quantity is customizable)\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>Administrators can require all users to change their passwords\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Done via a flag in each user’s database entry\u003C\u002Fli>\n\u003Cli>No mail is sent, keeping your server off of spam lists\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>Logs out idle sessions (optional) (idle time is customizable)\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>Maintenance mode (optional)\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Publicly viewable content remains visible\u003C\u002Fli>\n\u003Cli>Disables logins by all users, except administrators\u003C\u002Fli>\n\u003Cli>Logs out existing sessions, except administrators\u003C\u002Fli>\n\u003Cli>Disables posting of comments\u003C\u002Fli>\n\u003Cli>Useful for maintenance or emergency reasons\u003C\u002Fli>\n\u003Cli>This is separate from WordPress’ maintenance mode\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>Prevents information disclosures from failed logins\u003C\u002Fp>\n\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch4>Improvements Over Similar WordPress Plugins\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>Multisite network support\u003C\u002Fli>\n\u003Cli>Monitors authentication cookies for bad user names and hashes\u003C\u002Fli>\n\u003Cli>Tracks logins from XML-RPC requests\u003C\u002Fli>\n\u003Cli>Adjusts WordPress’ password policy user interfaces\u003C\u002Fli>\n\u003Cli>Takes security seriously so the plugin itself does not open your site\u003Cbr \u002F>\nto SQL, HTML, or header injection vulnerabilities\u003C\u002Fli>\n\u003Cli>Notice-free code means no information disclosures if \u003Ccode>display_errors\u003C\u002Fcode>\u003Cbr \u002F>\nis on and \u003Ccode>error_reporting\u003C\u002Fcode> includes \u003Ccode>E_NOTICE\u003C\u002Fcode>\u003C\u002Fli>\n\u003Cli>Only loads files, actions, and filters needed for enabled options\u003Cbr \u002F>\nand the page’s context\u003C\u002Fli>\n\u003Cli>Provides an option to have deactivation remove all of this plugin’s\u003Cbr \u002F>\ndata from the database\u003C\u002Fli>\n\u003Cli>Uses WordPress’ features rather than fighting or overriding them\u003C\u002Fli>\n\u003Cli>No advertising, promotions, or beacons\u003C\u002Fli>\n\u003Cli>Proper internationalization support\u003C\u002Fli>\n\u003Cli>Clean, documented code\u003C\u002Fli>\n\u003Cli>Unit tests covering 100% of the main class\u003C\u002Fli>\n\u003Cli>Internationalized unit tests\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>For reference, the similar plugins include:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002F6scan-protection\u002F\" rel=\"ugc\">6Scan Security\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fbetter-wp-security\u002F\" rel=\"ugc\">Better WP Security\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fenforce-strong-password\u002F\" rel=\"ugc\">Enforce Strong Password\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fforce-strong-passwords\u002F\" rel=\"ugc\">Force Strong Passwords\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Flimit-login-attempts\u002F\" rel=\"ugc\">Limit Login Attempts\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Flogin-lock\u002F\" rel=\"ugc\">Login Lock\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Flogin-lockdown\u002F\" rel=\"ugc\">Login LockDown\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fpmc-lockdown\u002F\" rel=\"ugc\">PMC Lockdown\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fsimple-login-lockdown\u002F\" rel=\"ugc\">Simple Login Lockdown\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fwordfence\u002F\" rel=\"ugc\">Wordfence Security\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fwp-login-security\u002F\" rel=\"ugc\">WP Login Security\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fwp-login-security-2\u002F\" rel=\"ugc\">WP Login Security 2\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch4>Compatibility with Other Plugins\u003C\u002Fh4>\n\u003Cp>Some plugins provide similar functionality.  These overlaps can lead to\u003Cbr \u002F>\nconflicts during program execution.  Please read the FAQ!\u003C\u002Fp>\n\u003Ch4>Translations\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>Deutsche, Deutschland (German, Germany) (de_DE) by Christian Foellmann\u003C\u002Fli>\n\u003Cli>Français, français (French, France) (fr_FR) by \u003Ca href=\"https:\u002F\u002Fprofiles.wordpress.org\u002Fmermouy\" rel=\"nofollow ugc\">mermouy\u003C\u002Fa> and and Fx Bénard\u003C\u002Fli>\n\u003Cli>Italiano, Italia (Italian, Italy) (it_IT) by Daniele Passalacqua\u003C\u002Fli>\n\u003Cli>日本語, 日本国 (Japanese, Japan) (ja_JP) by \u003Ca href=\"https:\u002F\u002Fprofiles.wordpress.org\u002Fmotoyamayuki\u002F\" rel=\"nofollow ugc\">motoyamayuki\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Nederlands, Nederland (Dutch, Netherlands) (nl_NL) by Friso van Wieringen\u003C\u002Fli>\n\u003Cli>polski, Polska (Polish, Poland) (pl_PL) by Michał Seweryniak \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fminiol\" rel=\"nofollow ugc\">miniol\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Português, Brasil (Portugese, Brazil) (pt_BR) by Valdir Trombini\u003C\u002Fli>\n\u003Cli>suomi, Suomi (Finnish, Finland) (fi_FI) by Juha Remes \u003Ca href=\"https:\u002F\u002Fgithub.com\u002FNewman101\" rel=\"nofollow ugc\">Newman101\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch4>Source Code, Bugs, and Feature Requests\u003C\u002Fh4>\n\u003Cp>Development of this plugin happens on\u003Cbr \u002F>\n\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fconvissor\u002Flogin-security-solution\" rel=\"nofollow ugc\">GitHub\u003C\u002Fa>.\u003Cbr \u002F>\nPlease submit\u003Cbr \u002F>\n\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fconvissor\u002Flogin-security-solution\u002Fissues\" rel=\"nofollow ugc\">bug and feature requests\u003C\u002Fa>,\u003Cbr \u002F>\n\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fconvissor\u002Flogin-security-solution\u002Fpulls\" rel=\"nofollow ugc\">pull requests\u003C\u002Fa>,\u003Cbr \u002F>\n\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fconvissor\u002Flogin-security-solution\u002Fwiki\" rel=\"nofollow ugc\">wiki entries\u003C\u002Fa>\u003Cbr \u002F>\nthere.\u003Cbr \u002F>\nReleases are then squashed and pushed to WordPress’\u003Cbr \u002F>\n\u003Ca href=\"https:\u002F\u002Fplugins.svn.wordpress.org\u002Flogin-security-solution\u002F\" rel=\"nofollow ugc\">Plugins SVN repository\u003C\u002Fa>.\u003Cbr \u002F>\nThis division is necessary due having being chastised that “the Plugins SVN\u003Cbr \u002F>\nrepository is a release system, not a development system.”\u003C\u002Fp>\n\u003Cp>Old tickets are in the \u003Ca href=\"https:\u002F\u002Fplugins.trac.wordpress.org\u002Fquery?status=assigned&status=closed&status=new&status=reopened&component=login-security-solution&col=id&col=summary&col=status&col=owner&col=type&col=priority&col=component&desc=1&order=id\" rel=\"nofollow ugc\">Plugins Trac\u003C\u002Fa>.\u003C\u002Fp>\n\u003Ch4>Strong, Unique Passwords Are Important\u003C\u002Fh4>\n\u003Cp>Yeah, creating, storing\u002Fremembering, and using a \u003Cstrong>different\u003C\u002Fstrong>, \u003Cstrong>strong\u003C\u002Fstrong>\u003Cbr \u002F>\npassword for each site you use is a hassle.  \u003Cem>But it is absolutely\u003Cbr \u002F>\nnecessary.\u003C\u002Fem>\u003C\u002Fp>\n\u003Cp>Password lists get stolen on a regular basis from big name sites (like\u003Cbr \u002F>\nLinkedin for example!).  Criminals then have unlimited time to decode the\u003Cbr \u002F>\npasswords.  In general, 50% of those passwords are so weak they get figured\u003Cbr \u002F>\nout in a matter of seconds.  Plus there are computers on the Internet\u003Cbr \u002F>\ndedicated to pounding the sites with login attempts, hoping to get lucky.\u003C\u002Fp>\n\u003Cp>Many people use the same password for multiple sites.  Once an attacker\u003Cbr \u002F>\nfigures out your password on one site, they’ll try it on your accounts at\u003Cbr \u002F>\nother sites.  It gets ugly very fast.\u003C\u002Fp>\n\u003Cp>But don’t despair!  There are good, free tools that make doing the right\u003Cbr \u002F>\nthing a piece of cake.  For example: \u003Ca href=\"http:\u002F\u002Fwww.keepassx.org\u002F\" rel=\"nofollow ugc\">KeePassX\u003C\u002Fa>,\u003Cbr \u002F>\n\u003Ca href=\"http:\u002F\u002Fkeepass.info\u002F\" rel=\"nofollow ugc\">KeePass\u003C\u002Fa>,\u003Cbr \u002F>\nor \u003Ca href=\"https:\u002F\u002Fagilebits.com\u002Fonepassword\" rel=\"nofollow ugc\">1Password\u003C\u002Fa>\u003C\u002Fp>\n\u003Ch4>Securing Your WordPress Site is Important\u003C\u002Fh4>\n\u003Cp>You’re probably thinking “There’s nothing valuable on my website. No one\u003Cbr \u002F>\nwill bother breaking into it.”  What you need to realize is that attackers\u003Cbr \u002F>\nare going after your visitors.  They put stealth code on your website\u003Cbr \u002F>\nthat pushes malware into your readers’ browsers.\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>According to SophosLabs more than 30,000 websites are infected\u003Cbr \u002F>\n  every day and 80% of those infected sites are legitimate.\u003Cbr \u002F>\n  Eighty-five percent of all malware, including viruses, worms,\u003Cbr \u002F>\n  spyware, adware and Trojans, comes from the web. Today,\u003Cbr \u002F>\n  drive-by downloads have become the top web threat.\u003C\u002Fp>\n\u003Cp>— \u003Ca href=\"http:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fsecurity-news-trends\u002Freports\u002Fsecurity-threat-report\u002Fhtml-08.aspx\" rel=\"nofollow ugc\">\u003Cem>Security Threat Report 2012\u003C\u002Fem>\u003C\u002Fa>\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>So if your site does get cracked, not only do you waste hours cleaning up,\u003Cbr \u002F>\nyour reputation gets sullied, security software flags your site as dangerous,\u003Cbr \u002F>\nand worst of all, you’ve inadvertently helped infect the computers of your\u003Cbr \u002F>\nclients and friends.  Oh, and if the attack involves malware, that malware\u003Cbr \u002F>\nhas probably gotten itself into your computer.\u003C\u002Fp>\n\u003Ch3>Actions\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>login_security_solution_insert_fail\u003C\u002Fli>\n\u003Cli>login_security_solution_notify_breach\u003C\u002Fli>\n\u003Cli>login_security_solution_notify_fail\u003C\u002Fli>\n\u003Cli>login_security_solution_fail_tier_dos\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Filters\u003C\u002Fh3>\n\u003Cp>The following filters allow customizing email subjects and messages.  If\u003Cbr \u002F>\neither the “subject”or “message” filters in a method returns an empty\u003Cbr \u002F>\nstring, the given method will skip calling \u003Ccode>wp_mail()\u003C\u002Fcode>.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>login_security_solution_notify_breach_subject\u003C\u002Fli>\n\u003Cli>login_security_solution_notify_breach_message\u003C\u002Fli>\n\u003Cli>login_security_solution_notify_breach_user_subject\u003C\u002Fli>\n\u003Cli>login_security_solution_notify_breach_user_message\u003C\u002Fli>\n\u003Cli>login_security_solution_notify_fail_subject\u003C\u002Fli>\n\u003Cli>login_security_solution_notify_fail_message\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch4>Unit Tests\u003C\u002Fh4>\n\u003Cp>A thorough set of unit tests are found in the \u003Ccode>tests\u003C\u002Fcode> directory.\u003C\u002Fp>\n\u003Cp>The plugin needs to be installed and activated before running the tests.\u003C\u002Fp>\n\u003Cp>To execute the tests, \u003Ccode>cd\u003C\u002Fcode> into this plugin’s directory and\u003Cbr \u002F>\ncall \u003Ccode>phpunit tests\u003C\u002Fcode>\u003C\u002Fp>\n\u003Cp>Translations can be tested by changing the \u003Ccode>WPLANG\u003C\u002Fcode> value in \u003Ccode>wp-config.php\u003C\u002Fcode>.\u003C\u002Fp>\n\u003Cp>Please note that the tests make extensive use of database transactions.\u003Cbr \u002F>\nMany tests will be skipped if your \u003Ccode>wp_options\u003C\u002Fcode> and \u003Ccode>wp_usermeta\u003C\u002Fcode> tables\u003Cbr \u002F>\nare not using the \u003Ccode>InnoDB\u003C\u002Fcode> storage engine.\u003C\u002Fp>\n\u003Ch4>Removal\u003C\u002Fh4>\n\u003Col>\n\u003Cli>\n\u003Cp>This plugin offers the ability to remove all of this plugin’s settings\u003Cbr \u002F>\nfrom your database.  Go to WordPress’ “Plugins” admin interface and\u003Cbr \u002F>\nclick the “Settings” link for this plugin.  In the “Deactivate” entry,\u003Cbr \u002F>\nclick the “Yes, delete the damn data” button and save the form.\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>Use WordPress’ “Plugins” admin interface to click the “Deactivate” link\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>Remove the \u003Ccode>login-security-solution\u003C\u002Fcode> directory from the server\u003C\u002Fp>\n\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Cp>In the event you didn’t pick the “Yes, delete the damn data” option or\u003Cbr \u002F>\nyou manually deleted the plugin, you can get rid of the settings by running\u003Cbr \u002F>\nthree queries.  These  queries are exapmles, using the default table name\u003Cbr \u002F>\nprefix of, \u003Ccode>wp_\u003C\u002Fcode>.  If you have changed your database prefix, adjust the\u003Cbr \u002F>\nqueries accordingly.\u003C\u002Fp>\n\u003Cpre>\u003Ccode>    DROP TABLE wp_login_security_solution_fail;\n\n    DELETE FROM wp_options WHERE option_name LIKE 'login-security-solution%';\n\n    DELETE FROM wp_usermeta WHERE meta_key LIKE 'login-security-solution%';= Inspiration and References =\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cul>\n\u003Cli>\n\u003Cp>Password Research\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"http:\u002F\u002Farstechnica.com\u002Fsecurity\u002F2012\u002F08\u002Fpasswords-under-assault\u002F\" rel=\"nofollow ugc\">Why passwords have never been weaker — and crackers have never been stronger\u003C\u002Fa>, Dan Goodin\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"http:\u002F\u002Fwww.cl.cam.ac.uk\u002F~jcb82\u002Fdoc\u002FB12-IEEESP-evaluating_a_huge_password_corpus.pdf\" rel=\"nofollow ugc\">You can never have too many passwords: techniques for evaluating a huge corpus\u003C\u002Fa>, Joseph Bonneau\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"http:\u002F\u002Fwww.cs.ru.nl\u002Fbachelorscripties\u002F2010\u002FMartin_Devillers___0437999___Analyzing_password_strength.pdf\" rel=\"nofollow ugc\">Analyzing Password Strength\u003C\u002Fa>, Martin Devillers\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"http:\u002F\u002Fwww.imperva.com\u002Fdocs\u002FWP_Consumer_Password_Worst_Practices.pdf\" rel=\"nofollow ugc\">Consumer Password Worst Practices\u003C\u002Fa>, Imperva\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"http:\u002F\u002Fwww.bryanrite.com\u002Fpreventing-brute-force-attacks-on-your-web-login\u002F\" rel=\"nofollow ugc\">Preventing Brute Force Attacks on your Web Login\u003C\u002Fa>, Bryan Rite\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"http:\u002F\u002Fxkcd.com\u002F936\u002F\" rel=\"nofollow ugc\">Password Strength\u003C\u002Fa>, Randall Munroe\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>Technical Info\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"http:\u002F\u002Fdoc.infosnel.nl\u002Fextreme_utf-8.html\" rel=\"nofollow ugc\">The Extreme UTF-8 Table\u003C\u002Fa>, infosnel.nl\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"http:\u002F\u002Ftools.ietf.org\u002Fhtml\u002Frfc5952\" rel=\"nofollow ugc\">A Recommendation for IPv6 Address Text Representation\u003C\u002Fa>, Seiichi Kawamura and Masanobu Kawashima\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>Password Lists\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"http:\u002F\u002Fdazzlepod.com\u002Fsite_media\u002Ftxt\u002Fpasswords.txt\" rel=\"nofollow ugc\">Dazzlepod Password List\u003C\u002Fa>, Dazzlepod\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"http:\u002F\u002Fwww.searchlores.org\u002Fcommonpass1.htm\" rel=\"nofollow ugc\">Common Passwords\u003C\u002Fa>, Fravia\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"http:\u002F\u002Fwww.whatsmypass.com\u002Fthe-top-500-worst-passwords-of-all-time\" rel=\"nofollow ugc\">The Top 500 Worst Passwords of All Time\u003C\u002Fa>, Mark Burnett\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch4>To Do\u003C\u002Fh4>\n\u003Cul>\n\u003Cli>Provide a user interface to the \u003Ccode>fail\u003C\u002Fcode> table.\u003C\u002Fli>\n\u003C\u002Ful>\n","Security against brute force attacks by tracking IP, name, password; requiring very strong passwords. Idle timeout. Maintenance mode lockdown.",4000,290214,54,"2017-11-28T10:46:00.000Z","4.4.34","3.3",[143,22,144,145,23],"login","passwords","strength","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Flogin-security-solution\u002F","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Flogin-security-solution.zip",{"attackSurface":149,"codeSignals":173,"taintFlows":191,"riskAssessment":192,"analyzedAt":197},{"hooks":150,"ajaxHandlers":169,"restRoutes":170,"shortcodes":171,"cronEvents":172,"entryPointCount":27,"unprotectedCount":27},[151,157,161,164,167],{"type":152,"name":153,"callback":154,"file":155,"line":156},"action","init","load_textdomain","enforce-strong-password.php",41,{"type":152,"name":158,"callback":159,"priority":27,"file":155,"line":160},"user_profile_update_errors","validate_password_reset",42,{"type":152,"name":162,"callback":162,"file":155,"line":163},"admin_menu",43,{"type":152,"name":165,"callback":165,"file":155,"line":166},"network_admin_menu",44,{"type":152,"name":159,"callback":159,"file":155,"line":168},45,[],[],[],[],{"dangerousFunctions":174,"sqlUsage":175,"outputEscaping":177,"fileOperations":27,"externalRequests":27,"nonceChecks":27,"capabilityChecks":27,"bundledLibraries":190},[],{"prepared":27,"raw":27,"locations":176},[],{"escaped":27,"rawEcho":178,"locations":179},4,[180,183,186,188],{"file":155,"line":181,"context":182},128,"raw output",{"file":184,"line":185,"context":182},"includes\\zan.php",11,{"file":184,"line":187,"context":182},16,{"file":184,"line":189,"context":182},63,[],[],{"summary":193,"deductions":194},"The \"enforce-strong-password\" plugin v1.3.5 exhibits a generally positive security posture based on the static analysis provided. There are no identified entry points that are unprotected, and the plugin does not utilize dangerous functions, perform file operations, or make external HTTP requests. The use of prepared statements for all SQL queries is a significant strength, mitigating risks of SQL injection. The lack of any recorded vulnerabilities in its history also suggests a history of secure development or diligent patching.\n\nHowever, a critical concern emerges from the static analysis regarding output escaping. With 4 total outputs and 0% properly escaped, this indicates a high risk of Cross-Site Scripting (XSS) vulnerabilities. Any user-supplied data or dynamically generated content that is outputted by this plugin without proper sanitization could be exploited by attackers to inject malicious scripts into the website, potentially leading to session hijacking, defacement, or redirection to malicious sites.\n\nWhile the plugin's attack surface is zero and it has no recorded CVEs, the complete absence of output escaping is a serious deficiency. This suggests a need for immediate review and remediation of all output mechanisms within the plugin to ensure proper sanitization before rendering any data. The plugin's strengths in other areas are overshadowed by this critical oversight, making it a moderate risk if not addressed.",[195],{"reason":196,"points":33},"All outputs unescaped","2026-03-16T20:59:46.726Z",{"wat":199,"direct":205},{"assetPaths":200,"generatorPatterns":202,"scriptPaths":203,"versionParams":204},[201],"\u002Fwp-content\u002Fplugins\u002Fenforce-strong-password\u002Flanguages",[],[],[],{"cssClasses":206,"htmlComments":208,"htmlAttributes":221,"restEndpoints":223,"jsGlobals":224,"shortcodeOutput":225},[207],"zan-nag",[209,210,211,212,213,214,215,216,217,218,219,220],"source: http:\u002F\u002Fsltaylor.co.uk\u002Fblog\u002Fenforce-strong-wordpress-passwords\u002F","Copyright (c) Zaantar (email: zaantar@gmail.com)","This program is free software; you can redistribute it and\u002For modify","it under the terms of the GNU General Public License, version 2, as","published by the Free Software Foundation.","This program is distributed in the hope that it will be useful,","but WITHOUT ANY WARRANTY; without even the implied warranty of","MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the","GNU General Public License for more details.","You should have received a copy of the GNU General Public License","along with this program; if not, write to the Free Software","Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA",[222],"name=\"settings[hide_donation_button]\"",[],[],[]]