Yard | Warden

Yard Warden hardens core WordPress password and login flows:

• Password strength via zxcvbn-php. Scores passwords 0-4 (default 4) based on real guessability, not arbitrary character-class rules. User inputs (login, email, display name) are fed to zxcvbn so passwords containing them score lower.
• Minimum length enforcement (default 16) on top of the zxcvbn score.
• Generic login errors to prevent username enumeration on the wp-login form. Always on, no toggle. Only applies to authentication failures; password-reset and profile-update validation errors remain verbose so users can correct their input.
• Safer multisite onboarding. Auto-activates new signups server-side so no activation link is emailed and the wp-activate.php landing page (which would print username + plaintext password) is never reached. The welcome email is rewritten to contain a one-time password-reset link instead of a generated password.
• Login limiting via transient-based counters across three dimensions (IP+Username, IP, Username). Locks out brute-force attempts. Admin can clear all counters via Settings > Yard Warden.

Filters

• yard::warden/password/min-length (default 16) – Minimum character count.
• yard::warden/password/min-score (default 4) – Minimum zxcvbn score (0-4).
• yard::warden/login/generic-error (default Invalid credentials.) – Replacement login error message.
• yard::warden/login/leaky-error-codes (default ['invalid_username', 'invalid_email', 'incorrect_password']) – WP_Error codes to rewrite.
• yard::warden/onboarding/welcome-subject (default Welcome to <site>!) – Multisite welcome email subject.
• yard::warden/onboarding/welcome-body (default reset-link body) – Full welcome email body. Receives $user, $resetUrl, original body.
• yard::warden/limit-login/enabled (default true) – Set to false to disable login limiting entirely.
• yard::warden/limit-login/client-ip (default REMOTE_ADDR) – Override IP detection (e.g. for reverse proxies).
• yard::warden/limit-login/error-message (default Too many failed login attempts...) – Lockout error shown to the user.
• yard::warden/limit-login/skip-error-codes (default ['expired_session']) – WP_Error codes that do not count as failed attempts.
• yard::warden/limit-login/threshold/{dimension} (default 5 / 50 / 3) – Attempts before lockout per dimension (ip_user / ip / username).
• yard::warden/limit-login/window/{dimension} (default 300 / 3600 / 1500) – Counting window in seconds per dimension.
• yard::warden/limit-login/lockout/{dimension} (default 300 / 3600 / 1500) – Lockout duration in seconds per dimension.

Policy override example

add_filter('yard::warden/password/min-score', function (int $score) {
    return max($score, 4);
});