Cypress North Password Policy enforces a strong, modern password policy on your WordPress site. Defaults align with NIST 800-63B guidance: length over composition rules, denylist screening, breach-corpus checks, and rate-limited login. Every setting is admin-configurable.

What you get

A password rule engine that validates on user registration, password reset, and profile updates — covering minimum length, character requirements, breach-corpus check via the Have I Been Pwned k-anonymity API, denylist of common passwords, edit-distance check against the current password, and a per-user history check.
Layered failed-login lockout: separate thresholds per IP and per username, with rolling windows and auto-release. Generic “invalid credentials” error responses so locked state is not disclosed to attackers.
A soft-force interstitial that catches users at next login when their password is expired, breached, or below the active policy — they cannot escape without choosing a compliant new password.
Daily email summary for administrators when attack rates spike.
Per-user notification emails on password change, lockout, and expiration warnings.
GDPR exporter + eraser that integrate with WordPress’s built-in Personal Data tools.
Audit log of every relevant event (login failures, lockouts, password changes, compliance state transitions) viewable in the admin.
Cleanup cron that trims old failed-attempt rows on a configurable schedule.
WP-CLI wp cnpp unlock command to release a stuck IP or username without opening the admin.
Multisite-aware: super-admin can globally configure or delegate per-site management.

Designed to coexist with WordPress core

The plugin uses WordPress’s own password hashing (wp_hash_password) and never stores plaintext. The built-in zxcvbn strength meter is left intact. All integration is via documented WP filters and actions — deactivating the plugin removes its behavior cleanly.

External services

This plugin connects to an API to check for known breached passwords.

The Have I Been Pwned API (api.pwnedpasswords.com) receives only the first five characters of a SHA-1 hash — k-anonymity. No personally identifying information leaves the site and no plain text is transmitted. The check can be disabled entirely from Settings Password Policy Policy.

This service is provided by Have I Been Pwned (https://haveibeenpwned.com/) : terms of use , privacy policy

Privacy

This plugin processes data necessary to enforce account security. The full privacy disclosure is contributed to Tools Privacy Policy Guide when the plugin is active.

What is collected

Failed login attempts (IP, username attempted, timestamp).
Lockout events (identifier, lockout-until timestamp).
Password-change audit-log rows.
Per-user: timestamp of last password change, compliance flag, a small queue of one-way hashes of previous passwords, and the most recent HIBP breach-check result (if enabled).

Lawful basis

Legitimate interest in preventing brute-force credential attacks, plus regulatory and contractual obligations around password hygiene where applicable.

Retention

Failed-attempt rows: pruned daily by cron, default kept for the duration of the lockout window (typically 24 hours).
Audit-log rows: default 90 days, configurable.
Per-user compliance and history data: kept while the user account exists; removed via the GDPR eraser on request.

Third parties

The Have I Been Pwned API (api.pwnedpasswords.com) receives only the first five characters of a SHA-1 hash — k-anonymity. No personally identifying information leaves the site. The check can be disabled entirely from Settings Password Policy Policy.

Exporter + eraser

The plugin registers with WordPress’s built-in Personal Data tools (Tools Export Personal Data, Tools Erase Personal Data). Exports return four groups (failed attempts, lockouts, password-change events, compliance state). Erasure removes the password-change audit rows and every plugin-specific user_meta entry; lockout and failed-attempt rows are retained with the username field redacted so aggregate-attack statistics remain intact but the rows can no longer be linked to the individual.