About this plugin
Yard Warden hardens core WordPress password and login flows:
- Password strength via zxcvbn-php. Scores passwords 0-4 (default 4) based on real guessability, not arbitrary character-class rules. User inputs (login, email, display name) are fed to zxcvbn so passwords containing them score lower.
- Minimum length enforcement (default 16) on top of the zxcvbn score.
- Generic login errors to prevent username enumeration on the wp-login form. Always on, no toggle. Only applies to authentication failures; password-reset and profile-update validation errors remain verbose so users can correct their input.
- Safer multisite onboarding. Auto-activates new signups server-side so no activation link is emailed and the wp-activate.php landing page (which would print username + plaintext password) is never reached. The welcome email is rewritten to contain a one-time password-reset link instead of a generated password.
- Login limiting via transient-based counters across three dimensions (IP+Username, IP, Username). Locks out brute-force attempts. Admin can clear all counters via Settings > Yard Warden.
Filters
- yard::warden/password/min-length (default 16 ) – Minimum character count.
- yard::warden/password/min-score (default 4 ) – Minimum zxcvbn score (0-4).
- yard::warden/login/generic-error (default Invalid credentials. ) – Replacement login error message.
- yard::warden/login/leaky-error-codes (default ['invalid_username', 'invalid_email', 'incorrect_password'] ) – WP_Error codes to rewrite.
- yard::warden/onboarding/welcome-subject (default Welcome to <site>! ) – Multisite welcome email subject.
- yard::warden/onboarding/welcome-body (default reset-link body) – Full welcome email body. Receives $user, $resetUrl, original body.
- yard::warden/limit-login/enabled (default true ) – Set to false to disable login limiting entirely.
- yard::warden/limit-login/client-ip (default REMOTE_ADDR ) – Override IP detection (e.g. for reverse proxies).
- yard::warden/limit-login/error-message (default Too many failed login attempts... ) – Lockout error shown to the user.
- yard::warden/limit-login/skip-error-codes (default ['expired_session'] ) – WP_Error codes that do not count as failed attempts.
- yard::warden/limit-login/threshold/{dimension} (default 5 / 50 / 3 ) – Attempts before lockout per dimension ( ip_user / ip / username ).
- yard::warden/limit-login/window/{dimension} (default 300 / 3600 / 1500 ) – Counting window in seconds per dimension.
- yard::warden/limit-login/lockout/{dimension} (default 300 / 3600 / 1500 ) – Lockout duration in seconds per dimension.
Policy override example
add_filter('yard::warden/password/min-score', function (int $score) { return max($score, 4); });