Download the PHP package bbs-lab/wordpress-password-policy without Composer

On this page you can find all versions of the php package bbs-lab/wordpress-password-policy. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of bbs-lab/wordpress-password-policy

Informations about the package wordpress-password-policy

BBS Password Policy

Latest release PHP WordPress

Enforce configurable password complexity and mandatory password rotation for WordPress privileged accounts (administrators by default). Light, self-contained, and ready for compliance use-cases such as CNSR: 15+ characters, 3 of 4 character classes, 90-day rotation.

Built by Big Boss Studio.

Features

Requirements

Installation

From GitHub

Or download a release ZIP, then Plugins → Add New → Upload Plugin.

Activate

  1. Activate BBS Password Policy
  2. Open Settings → Password Policy
  3. Adjust roles / complexity / rotation if needed (CNSR defaults are already set)

On activation, existing users in target roles receive a fresh “last changed” timestamp so they are not locked out immediately.

Quick start (defaults)

Setting Default
Enabled true
Target roles administrator
Minimum length 15
Character classes upper, lower, digit, special
Required classes 3 of 4
Rotation enabled
Rotation period 90 days
Warning window 14 days
Force change in admin true

Length and complexity are independent checks: a password must satisfy both the minimum length and the N-of-4 rule.

On Add New User, the form defaults to subscriber. The policy only applies when the selected role is in Target roles (e.g. Administrator).

Configuration

All options live in the bbs_pp_settings option and are edited in Settings → Password Policy.

Key Default Description
enabled true Master switch
target_roles ['administrator'] Roles that must comply
min_length 15 Minimum password length (sanitized ≥ 8)
require_uppercase true Count uppercase toward complexity
require_lowercase true Count lowercase toward complexity
require_digit true Count digits toward complexity
require_special true Count special characters toward complexity
min_character_classes 3 How many enabled classes are required (1–4)
rotation_enabled true Require periodic renewal
rotation_days 90 Password lifetime in days
warning_days 14 Admin notice window before expiry
force_change_on_login true Redirect expired users to their profile in wp-admin
exclude_user_ids [] User IDs that bypass the policy

Usage

Complexity

When a targeted user sets or resets a password (profile, user-new, user-edit, reset form, REST), the plugin validates length and character classes. Invalid passwords are rejected server-side; the admin UI also keeps Add / Update disabled until the policy passes and hides the weak-password confirmation checkbox.

Rotation

Each successful password change stores a Unix timestamp in user meta bbs_pp_password_last_changed.

When the password is older than rotation_days:

  1. The user can still sign in (if force-change is on)
  2. wp-admin requests redirect to Profile
  3. An error notice asks for a new password
  4. After a successful change, the timestamp resets and access is restored

Profile panel

Targeted users (and admins editing them) see policy summary, last change date, and days remaining on the profile screen.

Developer API

Filters

Helpers

Storage

Key Type Purpose
bbs_pp_settings option Plugin settings array
bbs_pp_password_last_changed user meta Last password change (Unix timestamp)
bbs_pp_must_change_password user meta Force-renewal flag

Directory structure

Security

Passwords are never stored by this plugin — WordPress hashing only. Settings require manage_options. If you discover a security vulnerability, please email [email protected] instead of using the public issue tracker.

See SECURITY for details.

Changelog

Please see CHANGELOG for what has changed recently.

Credits

License

GPL-2.0-or-later. Please see License File for more information.

All versions of wordpress-password-policy with dependencies

PHP Build Version
Package Version
Requires php Version >=7.4
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package bbs-lab/wordpress-password-policy contains the following files

Loading the files please wait ...