Title: Disallow Pwned Password Author: Itineris Limited Published: 19 Tháng 2, 2019 Last modified: 19 Tháng 2, 2019 --- Tìm kiếm plugin Plugin này **chưa được cập nhật với 3 phiên bản mới nhất của WordPress**. Nó có thể không được hỗ trợ và bảo trì, và có thể xung đột với các phiên bản WordPress mới nhất. ![](https://s.w.org/plugins/geopattern-icon/disallow-pwned-passwords.svg) # Disallow Pwned Password Bởi [Itineris Limited](https://profiles.wordpress.org/itinerisltd/) [Tải về](https://downloads.wordpress.org/plugin/disallow-pwned-passwords.0.3.2.zip) * [Chi tiết](https://vi.wordpress.org/plugins/disallow-pwned-passwords/#description) * [Đánh giá](https://vi.wordpress.org/plugins/disallow-pwned-passwords/#reviews) * [Nhà phát triển](https://vi.wordpress.org/plugins/disallow-pwned-passwords/#developers) [Hỗ trợ](https://wordpress.org/support/plugin/disallow-pwned-passwords/) ## Mô tả Disallow WordPress and WooCommerce users using pwned passwords. ### Goal Spoiler Alert: **User passwords never leave your server, not even in hashed form**. Although reusing passwords is solely users’ fault but when evil attackers brute forced users’ passwords, and stole all their personal information or spent users’ hard earn money through your site. **Those lazy users blame you**, the site owner/ developer. > When processing requests to establish and change memorized secrets, verifiers > SHALL compare the prospective secrets against a list that contains values known > to be commonly-used, expected, or compromised. For example,… > * Passwords obtained from previous breach corpuses > — [NIST Digital Identity Guidelines](https://pages.nist.gov/800-63-3/sp800-63b.html) This plugin’s solely purpose is to **disallow WordPress and WooCommerce users reusing passwords listed in [Have I Been Pwned](https://haveibeenpwned.com/) database**. ### Usage Activate and forget. This plugin intercepts when: * creating new users on `/wp-admin/user-new.php` * changing other users’ passwords on `/wp-admin/user-edit.php` * changing your password on `/wp-admin/profile.php` * new user registration on `/wp-login.php?action=rp` Additional interceptions if WooCommerce is installed: * [`WC_Form_Handler::process_reset_password`](https://github.com/woocommerce/woocommerce/blob/master/includes/class-wc-form-handler.php) on Home » My account » Lost password * [`WC_Form_Handler::save_account_details`](https://github.com/woocommerce/woocommerce/blob/master/includes/class-wc-form-handler.php) on Home » My account » Account details * [`WC_Form_Handler::process_registration`](https://github.com/woocommerce/woocommerce/blob/master/includes/class-wc-form-handler.php) on Home » My account * [`WC_Checkout::validate_checkout`](https://github.com/woocommerce/woocommerce/blob/master/includes/class-wc-checkout.php) on Home » Checkout ### Explain It Like I’m Five * [Troy Hunt](https://www.troyhunt.com), a well-kown security expert, collected 6,493,641,194 (and counting) pwned passwords from previous security breaches * Pwned passwords stored as SHA-1 hashes on haveibeenpwned.com * Whenever WordPress / WooCommerce users attempt to change their passwords, this plugin hashes the user password * Take the first 5 characters from the hash * Ask haveibeenpwned.com for all pwned passwords with the same first 5 hash characters * Check how many times the user password appears on the have I been pwned database * Disallow the password change if it has been pwned Users aged older than five could learn more from: * [Have I Been Pwned’s FAQs](https://haveibeenpwned.com/FAQs) * [Why SHA-1 was chosen in the Pwned Passwords](https://www.troyhunt.com/introducing-306-million-freely-downloadable-pwned-passwords/) * [I’ve [Troy Hunt] Just Launched “Pwned Passwords” V2 With Half a Billion Passwords for Download](https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/#cloudflareprivacyandkanonymity) * [Validating Leaked Passwords with k-Anonymity](https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/) ### For Developers Fork the plugin on [GitHub](https://github.com/ItinerisLtd/disallow-pwned-passwords). ## Ảnh màn hình [⌊WordPress⌉⌊WordPress⌉[ WordPress [⌊WooCommerce⌉⌊WooCommerce⌉[ WooCommerce ## Hỏi đáp What are the minimum requirements? * PHP v7.0 * WordPress v4.9.8 * **(Optional)** WooCommerce v3.4.4 Did you just send all the passwords to someone else? No. **User passwords never leave your server, not even in hashed form**. How do you compare user passwords with the 6,493,641,194 pwned ones? Curious users can learn more from: * [I’ve Just Launched “Pwned Passwords” V2 With Half a Billion Passwords for Download](https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/#cloudflareprivacyandkanonymity) * [Validating Leaked Passwords with k-Anonymity](https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/) Paranoia users should check the [plugin implementation](https://github.com/ItinerisLtd/disallow-pwned-passwords/tree/master/src). What to do if I don’t trust haveibeenpwned.com? [Troy Hunt](https://www.troyhunt.com) is a well-kown security expert. You should trust him more than me (the plugin author). Anyways, you can replace the default API client with yours: ``` add(ClientInterface::class, YourCustomClient::class); }); ``` This plugin uses [league/container](https://packagist.org/packages/league/container). Learn more from [its documents](http://container.thephpleague.com/3.x/). What to do if I don’t trust the plugin author? Good question! You shouldn’t blindly trust any random security guide/plugin from the scary internet – including this one! Review the [plugin implementation](https://github.com/ItinerisLtd/disallow-pwned-passwords/tree/master/src). I have installed this plugin. Does it mean my WordPress site is *unhackable*? No website is _unhackable_. To have a secure WordPress site, you have to keep all these up-to-date: * WordPress core * PHP * this plugin * all other WordPress themes and plugins * everything on the server * other security practices * your mindset Strongly recommended: * [WP Password Argon Two](https://github.com/TypistTech/wp-password-argon-two) – Securely store WordPress user passwords in database with Argon2i hashing and SHA-512 HMAC using PHP’s native functions * [WP Cloudflare Guard](https://wordpress.org/plugins/wp-cloudflare-guard/) – Connecting WordPress with Cloudflare firewall, protect your WordPress site at DNS level. Automatically create firewall rules to block dangerous IPs * [Two-Factor](https://wordpress.org/plugins/two-factor/) * [wp-password-bcrypt](https://github.com/roots/wp-password-bcrypt) Can strong passwords been pwned? Yes. Example: * [`correct horse battery staple`](https://www.xkcd.com/936/) How to disable WooCommerce password strength meter? For testing only, use at your own risk! ``` add_action('wp_print_scripts', function () { wp_dequeue_script('wc-password-strength-meter'); }, 10000); ``` Will you add support for older PHP versions? Never! This plugin will only works on [actively supported PHP versions](https://secure.php.net/supported-versions.php). Don’t use it on **end of life** or **security fixes only** PHP versions. Note: Current version supports PHP 7.0 because wordpress.org svn pre-commit hook rejects PHP 7.1+ syntax. However, you should not use PHP 7.0 because [it has reached **end of life** since 10 January 2019](https://secure.php.net/eol.php). It looks awesome. Where can I find some more goodies like this? * Articles on [Itineris’ blog](https://www.itineris.co.uk/blog/) * More projects on [Itineris’ GitHub profile](https://github.com/itinerisltd) * More plugins on [Itineris](https://profiles.wordpress.org/itinerisltd/#content-plugins) and [TangRufus](https://profiles.wordpress.org/tangrufus/#content-plugins) wp. org profiles * Follow [@itineris_ltd](https://twitter.com/itineris_ltd) and [@TangRufus](https://twitter.com/tangrufus) on Twitter * Hire [Itineris](https://www.itineris.co.uk/services/) to build your next awesome site Besides wp.org, where can I give a ★★★★★ review? Thanks! Glad you like it. It’s important to let my boss knows somebody is using this project. Please consider: * give ★★★★★ reviews on [wp.org](https://wordpress.org/support/plugin/disallow-pwned-passwords/reviews/#new-post) * tweet something good with mentioning [@itineris_ltd](https://twitter.com/itineris_ltd) and [@TangRufus](https://twitter.com/tangrufus) * ️️★ star this [Github repo](https://github.com/ItinerisLtd/disallow-pwned-passwords) * watch this [Github repo](https://github.com/ItinerisLtd/disallow-pwned-passwords) * write blog posts * submit pull requests * [hire Itineris](https://www.itineris.co.uk/services/) Where to report security related issues? If you discover any security related issues, please email [hello@itineris.co.uk](https://vi.wordpress.org/plugins/disallow-pwned-passwords/hello@itineris.co.uk?output_format=md) instead of using the issue tracker. ## Đánh giá ![](https://secure.gravatar.com/avatar/0afc88ab02b1d95c375263c947383e2d478725d2c1cdd5d37b9b5df1597fa39b? s=60&d=retro&r=g) ### 󠀁[Works very well](https://wordpress.org/support/topic/works-very-well-393/)󠁿 [Luke Cavanagh](https://profiles.wordpress.org/lukefiretoss/) 23 Tháng 4, 2019 A solid solution for what should be built into WordPress core. ![](https://secure.gravatar.com/avatar/3089ff1456a3ba047f6b20713c8828dc7cec818fb0775415d83da1249ee047d2? s=60&d=retro&r=g) ### 󠀁[Automate a difficult job the easy way](https://wordpress.org/support/topic/automate-a-difficult-job-the-easy-way/)󠁿 [Mariano Pérez Caro](https://profiles.wordpress.org/mpcdigital/) 30 Tháng 3, 2019 All you have to do is activate it and it goes to work. Fantastic. [ Đọc tất cả 2 đánh giá ](https://wordpress.org/support/plugin/disallow-pwned-passwords/reviews/) ## Người đóng góp & Lập trình viên “Disallow Pwned Password” là mã nguồn mở. Những người sau đã đóng góp vào plugin này. Những người đóng góp * [ Itineris Limited ](https://profiles.wordpress.org/itinerisltd/) * [ Tang Rufus ](https://profiles.wordpress.org/tangrufus/) “Disallow Pwned Password” đã được dịch qua 1 ngôn ngữ. Cảm ơn [những người tham gia dịch](https://translate.wordpress.org/projects/wp-plugins/disallow-pwned-passwords/contributors) vì đóng góp của họ. [Dịch “Disallow Pwned Password” sang ngôn ngữ của bạn.](https://translate.wordpress.org/projects/wp-plugins/disallow-pwned-passwords) ### Muốn tham gia phát triển? [Duyệt code](https://plugins.trac.wordpress.org/browser/disallow-pwned-passwords/), check out [SVN repository](https://plugins.svn.wordpress.org/disallow-pwned-passwords/), hoặc theo dõi [nhật ký phát triển](https://plugins.trac.wordpress.org/log/disallow-pwned-passwords/) qua [RSS](https://plugins.trac.wordpress.org/log/disallow-pwned-passwords/?limit=100&mode=stop_on_copy&format=rss). ## Nhật ký thay đổi Please see [CHANGELOG](https://github.com/ItinerisLtd/disallow-pwned-passwords/blob/master/CHANGELOG.md) for more information on what has changed recently. ## Meta * Phiên bản **0.3.2** * Cập nhật lần cuối **8 năm trước** * Số lượt cài đặt **10+** * Phiên bản WordPress ** 4.9.8 hoặc cao hơn ** * Đã kiểm tra lên đến **5.0.30** * Phiên bản PHP ** 7.0 hoặc cao hơn ** * Ngôn ngữ * [English (US)](https://wordpress.org/plugins/disallow-pwned-passwords/) và [Norwegian (Bokmål)](https://nb.wordpress.org/plugins/disallow-pwned-passwords/). * [Dịch sang ngôn ngữ của bạn](https://translate.wordpress.org/projects/wp-plugins/disallow-pwned-passwords) * Thẻ * [authentication](https://vi.wordpress.org/plugins/tags/authentication/)[have-i-been-pwned](https://vi.wordpress.org/plugins/tags/have-i-been-pwned/) [password](https://vi.wordpress.org/plugins/tags/password/)[security](https://vi.wordpress.org/plugins/tags/security/) * [Nâng cao](https://vi.wordpress.org/plugins/disallow-pwned-passwords/advanced/) ## Đánh giá 5 trên 5 sao. * [ 2 5-star reviews ](https://wordpress.org/support/plugin/disallow-pwned-passwords/reviews/?filter=5) * [ 0 4-star reviews ](https://wordpress.org/support/plugin/disallow-pwned-passwords/reviews/?filter=4) * [ 0 3-star reviews ](https://wordpress.org/support/plugin/disallow-pwned-passwords/reviews/?filter=3) * [ 0 2-star reviews ](https://wordpress.org/support/plugin/disallow-pwned-passwords/reviews/?filter=2) * [ 0 1-star reviews ](https://wordpress.org/support/plugin/disallow-pwned-passwords/reviews/?filter=1) [Your review](https://wordpress.org/support/plugin/disallow-pwned-passwords/reviews/#new-post) [Xem tất cả đánh giá](https://wordpress.org/support/plugin/disallow-pwned-passwords/reviews/) ## Những người đóng góp * [ Itineris Limited ](https://profiles.wordpress.org/itinerisltd/) * [ Tang Rufus ](https://profiles.wordpress.org/tangrufus/) ## Hỗ trợ Có điều gì muốn nói? cần giúp đỡ? [Xem diễn đàn hỗ trợ](https://wordpress.org/support/plugin/disallow-pwned-passwords/)