Enhanced Password Protection is an automatically enabled security feature on Pressable designed to protect your WordPress sites. This feature helps prevent one of the most common causes of WordPress compromises: insecure Administrator user credentials.
When a user with elevated permissions (`publish_posts` or `edit_published_posts`) tries to set or use a weak or known-compromised password, Enhanced Password Protection blocks the attempt and prompts the user to choose a stronger password.
Additionally, newly created accounts will have their initial password checked. This keeps new accounts from starting with a weak or compromised password, including cases where the role is not available yet.
Enhanced Password Protection can apply during:
- Logging in
- Resetting a password
- Updating a password in wp-admin
- Registering a new account
- Creating a new user in wp-admin
What WordPress Users See
If a user submits a weak or known-compromised password, they will see an error explaining that the password is not allowed and should be replaced with a stronger, unique password.
User attempts to log in with a weak or compromised password
Notice: Your account has been blocked as a security precaution. To continue, you must reset your password
User proceeds to reset password
User is prompted to enter their account username or email:
User enters account username or email and is informed to check their email for a confirmation link
User checks their email and a password reset link is provided
User clicks the reset link and is prompted to set a new password.
User attempts to set a weak or compromised password. They are denied and informed why and what to do. Notice: Error: This password is known to be included in compromised password lists. Please choose something more unique.
A logged-in user attempts to edit their user and set a weak or compromised password
They are denied and informed why and what to do.
Error: This password is known to be included in compromised password lists. Please choose something more unique.
A logged-in user attempts to create a new user and set a weak or compromised password
They are denied and informed why and what to do.
Error: This password is known to be included in compromised password lists. Please choose something more unique.
What WP Users are Impacted
For existing WordPress site users, Enhanced Password Protection is limited to users with elevated editing capabilities. The check applies when the user can publish_posts or edit_published_posts. These are most commonly “Administrator” and “Editor” users.
New account registration and wp-admin user creation are checked regardless of role. This keeps new accounts from starting with weak or compromised passwords, including cases where the role is not available yet.
Privacy and Security
Enhanced Password Protection uses a privacy-preserving lookup flow:
- The site computes a password hash locally.
- The site sends only a partial prefix of that hash for verification.
- The verification service returns possible matching suffixes for known weak or compromised passwords.
- The site compares the result locally.
The full password and full password hash do not leave the site.
What this means for you
Most day-to-day use of WordPress should not change. The main difference is that insecure passwords may no longer be accepted for affected users.
This is a very good thing for site security because it reduces the chance that a guessed, reused, or previously exposed password could be used to compromise your site.
Frequently asked questions (FAQs)
Is this enabled on every site?
Yes, this is enabled on every Pressable site by default.
Why was my password rejected?
The password may have been blocked because it was too weak or because it appeared in a known compromised-password dataset.
Does this mean my site has been hacked?
Not necessarily. This feature is preventative. It is designed to stop risky passwords from being used before they can become a security problem.
Does Pressable see my password?
No. The password itself and the full password hash are not sent anywhere during the check.
Does the full password leave the site?
No. The site sends only a partial password-hash prefix for lookup and performs the final comparison locally.
What happens if the verification service is unavailable?
The check fails open and allows the attempt, so users are not locked out because of a temporary service or configuration issue.
What should I do if my password is rejected?
Choose a stronger, unique password that is not reused from another service or account.
Does this work with OnePress Login?
No. OnePress Login is passwordless, so it doesn’t use or check your WordPress password.
Does Password Protection require Jetpack?
No. Password Protection is implemented by WP Cloud at the platform level and does not require Jetpack.
What if Jetpack’s Account Protection feature is active?
Pressable’s Enhanced Password Protection feature will automatically disable itself if Jetpack’s Account Protection feature is detected as active.