Skip to content

Passwords

Password expiry

Every planAbout Passwords

Asks people to choose a new password after a set number of days, with an optional reminder beforehand and roles you can leave out.

What it does

Each password gets an age. When it is older than the limit you set, the person can still sign in, but is taken to their profile and asked to choose a new password before doing anything else.

A reminder can appear on the dashboard a number of days before the password expires, so nobody is surprised.

Why it matters

Some contracts, insurers and industry rules ask for regular password changes. Expiry also limits how long a leaked password stays useful.

Current advice favours long, unique passwords over frequent changes, so if nothing requires it, a long interval such as a year is enough.

Set it up

  1. Switch on Password Requirements on the Passwords tab. Expiry only runs while it is on.
  2. In section Expiry, choose how often in Expire passwords, from 30 days to a year.
  3. In Reminder before expiry, choose how many days ahead to warn people, or 0 for no reminder.
  4. Tick any Exempt roles, for example a shared kiosk account that must never be interrupted.
  5. Click Save Changes.

Good to know

For people whose password age is not known yet, the clock starts at their next sign-in, so switching expiry on never locks everyone out at once.

The new password must meet your password rules.

Which plan includes it

Password expiry is in every plan. Exempting roles and the advance reminder are part of Pro.

How it works, for developers
  • The age comes from user meta smg_password_changed, updated on profile_update, user_register and password_reset. When it is missing it is set at the next sign-in.
  • On sign-in (authenticate at priority 99) an expired password sets user meta smg_force_password_change. The sign-in still succeeds; current_screen then sends the person to profile.php#password and admin_notices shows the message.
  • Settings: smg_password_expiration (days, 0 never), smg_password_expiry_warning_days, smg_password_expiration_exempt_roles.

Quick answers about password expiry

What does Password expiry do in Stack Guard?

Each password gets an age. When it is older than the limit you set, the person can still sign in, but is taken to their profile and asked to choose a new password before doing anything else. A reminder can appear on the dashboard a number of days before the password expires, so nobody is surprised.

Why use password expiry on a WordPress site?

Some contracts, insurers and industry rules ask for regular password changes. Expiry also limits how long a leaked password stays useful. Current advice favours long, unique passwords over frequent changes, so if nothing requires it, a long interval such as a year is enough.

How do I set up password expiry?

1. Switch on Password Requirements on the Passwords tab. Expiry only runs while it is on. 2. In section Expiry, choose how often in Expire passwords, from 30 days to a year. 3. In Reminder before expiry, choose how many days ahead to warn people, or 0 for no reminder. 4. Tick any Exempt roles, for example a shared kiosk account that must never be interrupted. 5. Click Save Changes.

Which Stack Guard plan includes password expiry?

Password expiry is in every plan. Exempting roles and the advance reminder are part of Pro.

More in Passwords

Not running Stack Guard yet? It is free.

Download Free