March 7, 2018 by Paul G. | Blog, Features, Shield Pro

Is Your WordPress Password `Pwned`?

Shield Image

Re-using passwords is rarely a good idea, and re-using a password that has been part of a data breach spells trouble.

Luckily for all us WordPress admins, we now have a way to know if our passwords have ever been part of a known data breach. Last year Troy Hunt released a new password look-up service to his brilliant Have I Been Pwned.

The new serves provides an API where anyone can search for whether a password they’ve used in the past has ever been involved in a data security breach. He argues that if it has been, it shouldn’t be re-used.

You may or may not agree with that, that’s for you to decide. We definitely agree with that position and we think all WordPress admins should make a point of ensuring their passwords aren’t pwned.

As such, we’re making it an integral part of our upcoming User Password Policy system inside our Shield Security for WordPress.

What Are ‘Pwned’ Passwords?

If a password has been involved in a data breach and this data is accessible and relevant, it’s part of the ‘pwned passwords’ database.

Troy goes into much more detail here.

The aim of all this is: discourage the use of passwords that have been leaked as part of user account data breaches.

How do you know if a password is pwned? You can use the Pwned Passwords tool right now to look-up your password if you like.

How Does Shield Security Work With Pwned Passwords?

We’re bringing a new Password Policies module to the Shield WordPress plugin.

As part of this, we’ve integrated automatic look-up in the new ‘pwned passwords’ API v2.

If the option is enabled, at the moment a user sets a password, Shield will look it up on the database for whether or not it’s been pwned.

If it’s there, it’ll return an error for the user and they’ll need to choose another password.

Waait… Does Shield Send The User’s Password To A 3rd Party?

No.

With v2 of this service, Troy has made it really easy to obfuscate the passwords that are being sent to the API.

At no point does Shield either send the password, or even the fully hashed password, to the API.

Sounds Sweet! How can I get access to this?

This integration is coming as part of the new Password Policy module that’s already under development.

Shield will provide you with the following functionality:

  • prevent use of ‘pwned passwords’.
  • enforce minimum password length.
  • enforce minimum password strength.
  • enforce a password expiration.
  • apply these policies retrospectively to existing passwords forcing users to update passwords when they login again.
  • expire all passwords forcing all users to reset their passwords after they next login.

Feature Requests, Suggestions and Comments

This feature is under development at the moment so we’re interested to take on any suggestions and feedback you may have.

As always, you can leave comments below and we’ll get back to you.

Note: The Pwned Password lookup feature will be a free feature within Shield, reflecting the generously free nature of the API that Troy Hunt has provided. Other password policy settings may be Pro-only upon release.

ShieldPRO Testimonials
@pjernigan's Gravatar @pjernigan

Great Security for your website

I have been extremely happy with the ease and functionality of this Plugin. I love all the options you have to secure the site. I highly recommend this plugin.

@horncastlecs's Gravatar @horncastlecs

My website was hacked through google ads. Using this now and it seems to do gr8!

My website was hacked through google ads. Using this now and it seems to do gr8! Free version. Thanks.

@tburkart's Gravatar @tburkart

Works Really Well, No Plugin Conflicts Either

This firewall is really, really effective. But unlike some other ones, it is able to be turned off when i lock myself out. The interface does not have an overwhelming number of options, which i like. simple, clear instructions make it a must-use plugin for everyone. MOST IMPORTANTLY, however, is…

@donquicky's Gravatar @donquicky

Great plugin

Although this plugin is free it has great functionality. Just great!

Hey there good-lookin'! Do you like what you've read here? :)

If this cool feature is something you'd like, but you haven't gone PRO yet, click here to get started today. (no risk, with a 14-day satisfaction guarantee!)

You'll get all PRO features, including Malware Scanning, WP Config Protection, Plugin FileGuard, import/export, customer support, and so much more. Not only that, you'll get that warm, fuzzy feeling that comes from supporting our work and future development.

Follow Your Dreams (and go pro) →

Comments (1)

    When is this feature coming in? I have been using shield free since 2 years 🙂 I just upgraded to the paid version. It just says I love this plugin! Trust me it’s awesome.

Leave a Comment

Your email address will not be published. Required fields are marked *

Click to access the login or register cheese