Compromised or weak password check in WordPress

One of the best-known and oldest types of attack is the so-called brute-force attack. Put simply, it consists of trying combinations of usernames and passwords until hitting the one that grants access to the private area.

Although it may seem hard to pull off, several factors keep it an effective attack today. On the one hand, users still use insecure combinations, either widely used passwords (the famous 123456) or weak ones (words or number combinations that could be guessed in a not very large number of attempts).

On top of that, there are databases exposed in massive service breaches circulating online (such as Facebook's, a hack that exposed 500 million usernames and passwords). They could be used to obtain email addresses and passwords that may be in use on other services and, therefore, make brute-force attacks more effective.

Thanks to the security mechanisms we have in place, we are very reliable at detecting when a brute-force attack is under way, blocking further attempts from the attacker's IPs.

Even so, the best scenario is for users themselves to know they are using a vulnerable password and be able to change it before an attacker succeeds. So, for extra security, we have added a new mechanism that detects, when the legitimate user logs in, whether they have a weak or compromised password (one that appears in a database of breached passwords). If so, they are redirected to the WordPress password recovery page, which asks them to replace the password with a new, secure one.

For now this option is available for WordPress, and in the future it will be extended to the other most commonly used applications.