Password Strength Settings for WooCommerce

FAQ

Q: What does each level do?

A: The levels range from 0 (lowest) to 4 (highest). As passwords are typed, the strength meter will dynamically update Ìtumọ̀ Yorùbá: – this will disable the “Sign Up” button until the requirements have been met. It should be noted that Level 0 accepts any password, so messaging isnÌtumọ̀ Yorùbá: ’t shown (and therefore doesnÌtumọ̀ Yorùbá: ’t have admin fields).

Q: Where does this meter show up?

A: This should appear wherever the Password Strength Meter appears Ìtumọ̀ Yorùbá: – in the “My Account” page or during Checkout.

Q: How is the password strength determined?

A: The password strength is determined by code in WordPress core, more specifically using a library called “zxcvbn”, created by Dropbox. ThereÌtumọ̀ Yorùbá: ’s a more in-depth description of how this works in the plugin documentation.

Q: How can I require numbers, special characters, or a certain length?

A: This plugin doesnÌtumọ̀ Yorùbá: ’t allow for that functionality, because itÌtumọ̀ Yorùbá: ’s not part of the built-in WordPress password strength algorithms. Those restrictions have also been proven to be ineffective and frustrating for users. See How Password Strength is Determined.

Q: Why is my password marked as weak?

A: This is the most common question I get, and the short answer is I donÌtumọ̀ Yorùbá: ’t know, but you can likely figure it out with the guide on How Password Strength is Determined.

Q: This allows weak passwords during account creation in checkout Ìtumọ̀ Yorùbá: – what gives?

A: This is unfortunately unavoidable. As of writing, WooCommerce doesnÌtumọ̀ Yorùbá: ’t validate the password strength in the checkout page, so while the strength meter will show it doesnÌtumọ̀ Yorùbá: ’t enforce it. This isnÌtumọ̀ Yorùbá: ’t something IÌtumọ̀ Yorùbá: ’m able to work around, so share that you want validation on the password strength requirements in the official WooCommerce Ideas Board Ìtumọ̀ Yorùbá: – once itÌtumọ̀ Yorùbá: ’s active in WooCommerce, it will automatically be active here. 🙂

Q: My site was recently hacked. Is this plugin vulnerable, or does it cause vulnerabilities?

A: No, this plugin does not create any vulnerabilities. It does create additional displays for the client-side (in the userÌtumọ̀ Yorùbá: ’s browser), but not server-side where vulnerabilities are found. It is using the Password Strength Meter that is already in WordPress, and doesnÌtumọ̀ Yorùbá: ’t store or handle any information Ìtumọ̀ Yorùbá: – WordPress or WooCommerce are the only ones that see and manage passwords, not this plugin. For security advice, please check out this older but still valid security 101 guide IÌtumọ̀ Yorùbá: ’ve written.

Q: Where can I go if I find an issue or want to recommend a feature?

A: If you experience any issues, please let the developer know. If you have ideas for future features or improvements, head over to GitHub to see if something is in development or to help contribute.

Q: Dang, this is pretty awesome. Where can I see some of your other stuff?

A: You can check out the DannyÌtumọ̀ Yorùbá: ’s personal site at DanielSantoro.com. He doesnÌtumọ̀ Yorùbá: ’t keep up with it as much as heÌtumọ̀ Yorùbá: ’d like, but itÌtumọ̀ Yorùbá: ’s there.