Title: passwords
Last modified: August 22, 2016

---

# passwords

 *  Resolved [danMWD](https://wordpress.org/support/users/danmwd/)
 * (@danmwd)
 * [11 years, 10 months ago](https://wordpress.org/support/topic/passwords-12/)
 * Hi, I had a few questions regarding passwords and how they are handled in WP-
   Members.
 * I wanted to force users to use strong passwords but when I tried to add a plugin
   to do this – either it was ignoring WP-Members or WP-Members was ignoring it.
   I believe I have located the right script to edit (wp-members-register.php) where
   I might add my own strength checks – is this the correct place or is there some
   setting I am missing or should other plugins that check password strength be 
   working?
 * Secondly I noticed that when someone forgets their password the system sends 
   them a password in the clear to their email address – perhaps I am missing a 
   setting somewhere but would prefer if it could be done using the user_activation
   key (like core WordPress is doing now – at least I believe so). I believe that
   the script handling this is wp-members-core.php – is this correct? – and/or have
   I also missed a setting? I am somewhat concerned about the security of sending
   a new password rather than a key that can be used or expired once a new password
   is set.
 * If you could point me in the right direction or correct any misunderstanding 
   I might have that would be great.
 * Also I am also somewhat reluctant to start hacking at the code as any changes
   I make will be lost when the plugin is updated.
 * Thank you for your time on this matter.
 * [https://wordpress.org/plugins/wp-members/](https://wordpress.org/plugins/wp-members/)

Viewing 1 replies (of 1 total)

 *  Plugin Author [Chad Butler](https://wordpress.org/support/users/cbutlerjr/)
 * (@cbutlerjr)
 * [11 years, 10 months ago](https://wordpress.org/support/topic/passwords-12/#post-5248669)
 * Second question first – the plugin originally only allowed emailing of a random
   initial password (with the obvious intention that the user would change this 
   upon logging in). There’s not much difference between that and an activation 
   key, from a security standpoint.
 * Only recently has the option for user selected passwords during registration 
   been included in the plugin. However, with that option, you do not *have to* 
   send the user their login credentials since they are creating them at registration.
 * It may be that I add an activation key process in the future, but that would 
   come in some later version.
 * > Also I am also somewhat reluctant to start hacking at the code as any changes
   > I make will be lost when the plugin is updated.
 * A wise choice, since there are many hooks in the plugin for allowing proper customization.
 * If you want to enforce strong passwords, there are two action hooks you could
   use:
    - [wpmem_pre_register_data](http://rocketgeek.com/plugins/wp-members/users-guide/filter-hooks/wpmem_pre_register_data/)
    - [wpmem_pre_update_data](http://rocketgeek.com/plugins/wp-members/users-guide/filter-hooks/wpmem_pre_update_data/)
 * These two filters work essentially in the same manner. Hopefully it is obvious
   which processes they belong to.
 * Depending on whether you are allowing the user to create a password at registration,
   or they are doing it when update their profile would determine which to use (
   and you could use both hooked to the same function for the kind of validation
   you are talking about).
 * The information you need for how to use the hook to stop the process and return
   an error message is in the documentation for the register hook, but the update
   hook works the same way.

Viewing 1 replies (of 1 total)

The topic ‘passwords’ is closed to new replies.

 * ![](https://ps.w.org/wp-members/assets/icon-256x256.png?rev=1226414)
 * [WP-Members Membership Plugin](https://wordpress.org/plugins/wp-members/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/wp-members/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/wp-members/)
 * [Active Topics](https://wordpress.org/support/plugin/wp-members/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/wp-members/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/wp-members/reviews/)

## Tags

 * [password](https://wordpress.org/support/topic-tag/password/)

 * 1 reply
 * 2 participants
 * Last reply from: [Chad Butler](https://wordpress.org/support/users/cbutlerjr/)
 * Last activity: [11 years, 10 months ago](https://wordpress.org/support/topic/passwords-12/#post-5248669)
 * Status: resolved