# Configuring password policies in WordPress

> Enforce strong passwords for WordPress users, including length and expiry rules, with the Password Policy Manager plugin.

Source: https://helpcenter.ruachost.com/wordpress/guides/configuring-password-policies-in-wordpress/

Weak passwords are one of the most common security risks in WordPress. To protect your site, administrators can enforce strong password policies. On **ruachost.com**, this is easily done using the **Password Policy Manager plugin**.

## Why Configure Password Policies?

- Prevent unauthorized access to user accounts.
- Enforce strong password requirements (length, characters, expiration).
- Improve overall site security and compliance.

## Steps to Configure Password Policies

1. **Log in to WordPress** with an administrator account.
2. In the dashboard, go to **Plugins → Add New**.
3. Search for **Password Policy Manager**.
4. Click **Install Now**, then **Activate**.
5. In the dashboard, go to **miniOrange Password Policy → Password Policy**.
6. Configure the following settings:

   - **Password Length** → Minimum of 8 characters recommended.
   - **Character Requirements** → Enforce uppercase, lowercase, numbers, and special characters.
   - **Password Expiration** → Set according to your organization’s policy (e.g., 12 weeks).
   - **Login Restrictions** → Limit failed login attempts to prevent brute‑force attacks.
7. Click **Save Settings**.

✅ Password policies are now enforced for all users on your WordPress site.

## Important Notes

- Strong password policies may reduce convenience but greatly improve security.
- Always inform users of new requirements to avoid login issues.
- Combine password policies with **two‑factor authentication (2FA)** for maximum protection.
- Back up your site before making major security changes.