Enforce Strong Passwords for All Users in WordPress

Code

<?php

// Enforce strong passwords for all users in WordPress

// Hook into the password reset and user profile update processes
add_action('user_profile_update_errors', 'wp_dudecom_enforce_strong_passwords', 10, 3);
add_action('validate_password_reset', 'wp_dudecom_enforce_strong_passwords', 10, 2);

/**
 * Enforce strong passwords for WordPress users.
 *
 * @param WP_Error $errors Error object to add errors to.
 * @param bool $update Whether this is a user update.
 * @param object $user User object.
 */
function wp_dudecom_enforce_strong_passwords($errors, $update, $user) {
    if (empty($_POST['pass1'])) {
        return;
    }

    $password = $_POST['pass1'];

    // Check password strength
    if (!wp_dudecom_is_strong_password($password)) {
        $errors->add('weak_password', __('Please use a stronger password. A strong password should be at least 8 characters long and include a mix of uppercase, lowercase, numbers, and special characters.'));
    }
}

/**
 * Check if a password is strong.
 *
 * @param string $password The password to check.
 * @return bool True if the password is strong, false otherwise.
 */
function wp_dudecom_is_strong_password($password) {
    // Minimum length of 8 characters
    if (strlen($password) < 8) {
        return false;
    }

    // Check for at least one uppercase letter
    if (!preg_match('/[A-Z]/', $password)) {
        return false;
    }

    // Check for at least one lowercase letter
    if (!preg_match('/[a-z]/', $password)) {
        return false;
    }

    // Check for at least one number
    if (!preg_match('/[0-9]/', $password)) {
        return false;
    }

    // Check for at least one special character
    if (!preg_match('/[\W]/', $password)) {
        return false;
    }

    return true;
}

?>