Passwords

Forced password resets

Makes chosen users, or everyone, pick a new password the next time they sign in. Use it after a suspected break-in, a staff change or a new password policy.

What it does

You can force everyone at once (optionally leaving out administrators), pick specific users, or target the users whose current password has never been checked against your rules.

Why it matters

New password rules only apply when a password changes. A forced reset makes every old, weak password go away now, and after a break-in it makes sure stolen passwords stop working.

Set it up

Go to the Passwords tab, section Forced resets.
To reset everyone, use Force All Users. Leave Exclude administrators on if you only want to reset other roles, and tick Send notification email to tell people why.
To reset some people, use Force Specific Users and search for them by name or email.
Check Pending Password Resets to see who has not changed their password yet. Resend emails them again; Clear cancels the reset.
Users with Unchecked Passwords lists people whose password was set before your rules; reset them one by one or all together.

Good to know

You can never force a reset on your own account from here, so you cannot lock yourself out.

A forced reset does not sign people out. To end every open session as well, use Force Logout on the Dashboard or Sign Out Everywhere on the Access tab.

The email links to the standard WordPress sign-in address. If you use a custom login address, tell people the right address separately.

Which plan includes it

Forced resets are part of Pro. Accounts already marked stay marked if the plan ends, until each person changes their password.

How it works, for developers

A reset sets user meta smg_force_password_change, plus smg_force_password_date, smg_force_password_by and smg_force_password_reason.
Enforcement: admin_init sends the user to profile.php?smg_force_reset=1 (the profile, AJAX and sign-out stay reachable) and template_redirect does the same on the front end.
The mark clears when the profile is saved with a new password or on password_reset.
The AJAX actions behind the buttons need the manage_options capability and the Pro force_password_reset feature.

Quick answers about forced password resets

What does Forced password resets do in Stack Guard?

A forced reset marks an account. The next time that person signs in, they can only reach their profile until they set a new password. Visiting the front of the site while signed in takes them there too. You can force everyone at once (optionally leaving out administrators), pick specific users, or target the users whose current password has never been checked against your rules.

Why use forced password resets on a WordPress site?

New password rules only apply when a password changes. A forced reset makes every old, weak password go away now, and after a break-in it makes sure stolen passwords stop working.

How do I set up forced password resets?

1. Go to the Passwords tab, section Forced resets. 2. To reset everyone, use Force All Users. Leave Exclude administrators on if you only want to reset other roles, and tick Send notification email to tell people why. 3. To reset some people, use Force Specific Users and search for them by name or email. 4. Check Pending Password Resets to see who has not changed their password yet. Resend emails them again; Clear cancels the reset. 5. Users with Unchecked Passwords lists people whose password was set before your rules; reset them one by one or all together.

Which Stack Guard plan includes forced password resets?

Forced resets are part of Pro. Accounts already marked stay marked if the plan ends, until each person changes their password.

More in Passwords

Not running Stack Guard yet? It is free.

Download Free