--- title: Enhanced Password Protection url: "https://pressable.com/knowledgebase/enhanced-password-protection/" published: 2026-07-21 modified: 2026-07-21 author: Zach Wiesman --- *Enhanced Password Protection* is an automatically enabled security feature on Pressable designed to protect your WordPress sites. This feature helps prevent one of the most common causes of WordPress compromises: insecure Administrator user credentials. When a user with elevated permissions (`publish\_posts` or `edit\_published\_posts`) tries to set or use a weak or known-compromised password, *Enhanced Password Protection* blocks the attempt and prompts the user to choose a stronger password. Additionally, newly created accounts will have their initial password checked. This keeps new accounts from starting with a weak or compromised password, including cases where the role is not available yet. *Enhanced Password Protection* can apply during: - Logging in - Resetting a password - Updating a password in wp-admin - Registering a new account - Creating a new user in wp-admin ### What WordPress Users See If a user submits a weak or known-compromised password, they will see an error explaining that the password is not allowed and should be replaced with a stronger, unique password. #### User attempts to log in with a weak or compromised password Notice: Your account has been blocked as a security precaution. To continue, you must reset your password ![Pressable's Enhanced Password Protection weak or compromised password notice.](https://i0.wp.com/pressable.com/wp-content/uploads/2026/07/password-protection-password-notice.png?resize=798%2C1023&ssl=1)#### User proceeds to reset password User is prompted to enter their account username or email: ![](https://i0.wp.com/pressable.com/wp-content/uploads/2026/07/password-protection-reset-pw-step1.jpg?ssl=1)**User enters account username or email and is informed to check their email for a confirmation link** ![](https://i0.wp.com/pressable.com/wp-content/uploads/2026/07/user-check-email-for-confirmation-link.jpg?ssl=1)**User checks their email and a password reset link is provided** ![](https://i0.wp.com/pressable.com/wp-content/uploads/2026/07/email-password-reset-link.jpg?ssl=1)**User clicks the reset link and is prompted to set a new password.** ![](https://i0.wp.com/pressable.com/wp-content/uploads/2026/07/enter-new-password.jpg?ssl=1)**User attempts to set a weak or compromised password. They are denied and informed why and what to do.** **Notice**: Error: This password is known to be included in compromised password lists. Please choose something more unique. ![](https://i0.wp.com/pressable.com/wp-content/uploads/2026/07/new-password-rejected-message.jpg?ssl=1)#### **A logged-in user attempts to edit their user and set a weak or compromised password** They are denied and informed why and what to do. Error: This password is known to be included in compromised password lists. Please choose something more unique. ![](https://i0.wp.com/pressable.com/wp-content/uploads/2026/07/logged-in-pw-edit-rejection.jpg?ssl=1)#### **A logged-in user attempts to create a new user and set a weak or compromised password** They are denied and informed why and what to do. Error: This password is known to be included in compromised password lists. Please choose something more unique. ![](https://i0.wp.com/pressable.com/wp-content/uploads/2026/07/logged-in-user-create-user-pw-rejection-message.jpg?ssl=1)### What WP Users are Impacted For existing WordPress site users, Enhanced Password Protection is limited to users with elevated editing capabilities. The check applies when the user can publish\_posts or edit\_published\_posts. These are most commonly “Administrator” and “Editor” users. New account registration and wp-admin user creation are checked regardless of role. This keeps new accounts from starting with weak or compromised passwords, including cases where the role is not available yet. ### Privacy and Security Enhanced Password Protection uses a privacy-preserving lookup flow: - The site computes a password hash locally. - The site sends only a partial prefix of that hash for verification. - The verification service returns possible matching suffixes for known weak or compromised passwords. - The site compares the result locally. The full password and full password hash do not leave the site. ### What this means for you Most day-to-day use of WordPress should not change. The main difference is that insecure passwords may no longer be accepted for affected users. This is a very good thing for site security because it reduces the chance that a guessed, reused, or previously exposed password could be used to compromise your site. ### Frequently asked questions (FAQs) #### Is this enabled on every site? Yes, this is enabled on every Pressable site by default. #### Why was my password rejected? The password may have been blocked because it was too weak or because it appeared in a known compromised-password dataset. #### Does this mean my site has been hacked? Not necessarily. This feature is preventative. It is designed to stop risky passwords from being used before they can become a security problem. #### Does Pressable see my password? No. The password itself and the full password hash are not sent anywhere during the check. #### Does the full password leave the site? No. The site sends only a partial password-hash prefix for lookup and performs the final comparison locally. #### What happens if the verification service is unavailable? The check fails open and allows the attempt, so users are not locked out because of a temporary service or configuration issue. #### What should I do if my password is rejected? Choose a stronger, unique password that is not reused from another service or account. #### Does this work with OnePress Login? No. [OnePress Login](https://pressable.com/knowledgebase/pressable-onepress-login/) is passwordless, so it doesn’t use or check your WordPress password. #### Does Password Protection require Jetpack? No. Password Protection is implemented by WP Cloud at the platform level and does not require Jetpack. #### What if [Jetpack’s Account Protection ](https://jetpack.com/support/improve-your-wp-admin-password-security-with-account-protection/)feature is active? Pressable’s Enhanced Password Protection feature will automatically disable itself if [Jetpack’s Account Protection](https://jetpack.com/support/improve-your-wp-admin-password-security-with-account-protection/) feature is detected as active.