[WordPress] 外掛分享： Cypress North Password Policy

內容簡介

Cypress North Password Policy 外掛為您的 WordPress 網站強制執行現代化的密碼政策，符合 NIST 800-63B 指導原則，提供安全性與靈活性，確保用戶密碼的強度與安全性。

【主要功能】
• 密碼規則引擎，驗證用戶註冊與密碼重設
• 分層失敗登錄鎖定，根據 IP 和用戶名設定閾值
• 密碼過期提醒，強制用戶選擇新密碼
• 每日攻擊率摘要郵件通知管理員
• GDPR 數據導出與刪除功能
• 審計日誌記錄所有相關事件

外掛標籤

開發者團隊

原文外掛簡介

Cypress North Password Policy enforces a strong, modern password policy on your WordPress site. Defaults align with NIST 800-63B guidance: length over composition rules, denylist screening, breach-corpus checks, and rate-limited login. Every setting is admin-configurable.
What you get

A password rule engine that validates on user registration, password reset, and profile updates — covering minimum length, character requirements, breach-corpus check via the Have I Been Pwned k-anonymity API, denylist of common passwords, edit-distance check against the current password, and a per-user history check.
Layered failed-login lockout: separate thresholds per IP and per username, with rolling windows and auto-release. Generic “invalid credentials” error responses so locked state is not disclosed to attackers.
A soft-force interstitial that catches users at next login when their password is expired, breached, or below the active policy — they cannot escape without choosing a compliant new password.
Daily email summary for administrators when attack rates spike.
Per-user notification emails on password change, lockout, and expiration warnings.
GDPR exporter + eraser that integrate with WordPress’s built-in Personal Data tools.
Audit log of every relevant event (login failures, lockouts, password changes, compliance state transitions) viewable in the admin.
Cleanup cron that trims old failed-attempt rows on a configurable schedule.
WP-CLI wp cnpp unlock command to release a stuck IP or username without opening the admin.
Multisite-aware: super-admin can globally configure or delegate per-site management.

Designed to coexist with WordPress core
The plugin uses WordPress’s own password hashing (wp_hash_password) and never stores plaintext. The built-in zxcvbn strength meter is left intact. All integration is via documented WP filters and actions — deactivating the plugin removes its behavior cleanly.
External services
This plugin connects to an API to check for known breached passwords.
The Have I Been Pwned API (api.pwnedpasswords.com) receives only the first five characters of a SHA-1 hash — k-anonymity. No personally identifying information leaves the site and no plain text is transmitted. The check can be disabled entirely from Settings → Password Policy → Policy.
This service is provided by Have I Been Pwned (https://haveibeenpwned.com/) : terms of use , privacy policy
Privacy
This plugin processes data necessary to enforce account security. The full privacy disclosure is contributed to Tools → Privacy Policy Guide when the plugin is active.
What is collected

Failed login attempts (IP, username attempted, timestamp).
Lockout events (identifier, lockout-until timestamp).
Password-change audit-log rows.
Per-user: timestamp of last password change, compliance flag, a small queue of one-way hashes of previous passwords, and the most recent HIBP breach-check result (if enabled).

Lawful basis
Legitimate interest in preventing brute-force credential attacks, plus regulatory and contractual obligations around password hygiene where applicable.
Retention

Failed-attempt rows: pruned daily by cron, default kept for the duration of the lockout window (typically 24 hours).
Audit-log rows: default 90 days, configurable.
Per-user compliance and history data: kept while the user account exists; removed via the GDPR eraser on request.

Third parties
The Have I Been Pwned API (api.pwnedpasswords.com) receives only the first five characters of a SHA-1 hash — k-anonymity. No personally identifying information leaves the site. The check can be disabled entirely from Settings → Password Policy → Policy.
Exporter + eraser
The plugin registers with WordPress’s built-in Personal Data tools (Tools → Export Personal Data, Tools → Erase Personal Data). Exports return four groups (failed attempts, lockouts, password-change events, compliance state). Erasure removes the password-change audit rows and every plugin-specific user_meta entry; lockout and failed-attempt rows are retained with the username field redacted so aggregate-attack statistics remain intact but the rows can no longer be linked to the individual.

延伸相關外掛

Wordfence Security – Firewall, Malware Scan, and Login SecurityWordfence Security 是最受歡迎的 WordPress 安全防護外掛，...Hostinger ToolsHostinger Tools 是一款多合一網站管理外掛，協助 WordPress ...Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)le Plugins include Complianz GDPR, Disable Updates Manage...Jetpack – WP Security, Backup, Speed, & GrowthJetpack 是一款多合一 WordPress 外掛，整合網站安全防護、自...ManageWP WorkerManageWP Worker 是一款專為管理多個 WordPress 網站而設計的...Security Optimizer – The All-In-One Protection PluginSecurity Optimizer 是一款全方位的 WordPress 安全外掛，能...Safe SVGSafe SVG 可以讓你安心地在 WordPress 中上傳 SVG 檔案！ 它...LoginizerLoginizer 是一款 WordPress 安全防護外掛，主要用於阻擋暴力...Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force PreventionLimit Login Attempts Reloaded 是一款強大的安全外掛，旨在...All-In-One Security (AIOS) – Security and FirewallAll-In-One Security (AIOS) 是一款功能全面的 WordPress 安...User Role Editor「User Role Editor」WordPress 外掛讓您輕鬆更改使用者角色...MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple SitesMainWP Child 外掛可將你的 WordPress 網站安全連線至自架的 ...Kadence Security – Password, Two Factor Authentication, and Brute Force ProtectionSolid Security 是一款專為 WordPress 網站設計的安全外掛，...Sucuri Security – Auditing, Malware Scanner and Security HardeningSucuri Security 外掛旨在保護您的 WordPress 網站，提供全面...SiteGuard WP Plugin版本: 1.6.7 您可以在日文網頁和英文網頁上找到文件、常見問...