Scanning for weak passwords = not working?

Hi Erik,

It doesn’t appear that it is functioning on your site. Will you try removing Wordfence and table data and try reinstalling the plugin? If you have any settings you want to keep, you can export before uninstalling and import after reinstalling.

-Brian

Hello Brian,

Thanks for the quick reply. I have done as you said, removed Wordfence, dropped all wf table data, re-installed Wordfence. But still a weak password as ‘test’ is ignored and not detected in the password test of the scan.

I already also tried it on another (multisite!) WordPress website where I installed Wordfence for the 1st time, same issue. Pleas note this is a multisite setup, I don’t know if WF is compatible. My other site where the problem was first detected is not a multisite setup! ??

I looks like it is a bug within WF?

Looking forward to your reply, thanks! ??

Hi Erik,

The test for weak passwords checks for some of the most common bad passwords that are tested by bots, but can’t identify every possible bad password. When choosing a password in WordPress, it labels “test123” as “very weak” and won’t let you save it unless you check a box that says “Confirm use of weak password”.

When Wordfence is scanning, it doesn’t have access to the users’ unencrypted passwords, so it’s not possible to use a long list of possible passwords on most web hosts, and still complete the scan in a reasonable amount of time.

If you need extremely thorough password audits, Wordfence premium can run admin passwords against a list of 260 million passwords, and lower user accounts against a list of 50,000 passwords. These audits are done on our servers, since they would take months (or years) to run once on a typical web server. Details on the password audits are available here:
https://docs.wordfence.com/en/Wordfence_Password_Auditing

-Matt R

Hello Matt,

Thanks for your clear answer!

I don’t know if it is possible, but maybe WF can be improved to be able to access the encrypted users passwords within a wordpress install?

Again, I don’t know if this is technically possible, but it would make efficient checking possible if all existing passwords are secure ??

Your hunch was correct! It’s actually not possible to get the unencrypted passwords when they’re stored in the database. WordPress uses “hashing” when storing passwords, so that even if someone gets a hold of your site’s passwords, they can’t actually tell what they are without a lot of math — and a lot of time and/or processing power.

If you’re interested, we have a detailed article about how passwords are stored in modern systems, here:
https://www.wordfence.com/learn/passwords-and-password-cracking/

-Matt R