Password policy
Complexity rules, expiry with a grace period, and a history that refuses reuse — plus the one setting that switches the lot off.
- Intermediate
- 7 min read
- Applies to 2.0
Before anything else
The policy only applies while the security mode is something other than None. The Passwords tab says so, and tells you which of the two situations you are in — a notice reading Not applied means the mode is None and every rule below is being ignored.
If you have set rules and members are still choosing password1, check
the security mode first.
Turning it on
User Access → Passwords → Enable Password Policy. The rules appear once it is on.
The Passwords tab with the policy enabled: length, character requirements and disallowed values.
Complexity
- Minimum length — 4 to 64 characters, default 8.
- Character requirements — uppercase, lowercase, numbers, special characters, each an independent tick.
- Disallowed values — refuse a password containing the username, refuse one containing the email address, and check against a list of common passwords.
Length does more for a password than any of the character rules. A 14-character minimum with no other requirement is harder to guess, and far easier to live with, than an 8-character one that demands four kinds of character.
Reset behaviour
- Reset token expiration — how long a reset link stays valid, 1 to 72 hours, default 24.
- Reset notifications — email the member whenever their password changes. Worth leaving on: it is how someone finds out their account was taken.
- Admin notifications — tell the site administrator when repeated reset attempts are detected.
Expiry
Enable Expiration makes passwords age out.
- Expiration period — days before a password must be changed, default 90.
- Expiration warning — how many days ahead the warnings start, default 7.
- Grace period — days after expiry during which the member can still sign in, with a warning asking them to change it. Default 3.
When the grace period runs out they are signed out and sent to the password reset page.
Forced expiry is out of favour with most security guidance now: made to change every 90 days, people pick weaker passwords and increment a number on the end. Consider leaving it off unless a compliance rule requires it, and if you do turn it on, keep a grace period so nobody is locked out mid-task.
History
Enable Password History refuses a password the member has used before, and Password History Size sets how far back it remembers — 1 to 24, default 5.
It pairs with expiry: without history, expiry mostly teaches people to alternate between two passwords.
What the policy does not cover
It governs passwords. It does not throttle sign-in attempts — that is login throttling — and it has no bearing on members signing in by magic link or authenticator app, who have no password in play at all.
Something missing or out of date? Tell support.