My particular problem was a bit different. It turned out that users weren’t putting in strong enough passwords, but the validation messages weren’t showing up. We use Advanced Custom Fields, and the validation doesn’t show up when the form shortcode is used in an ACF field. Once I put it into the regular WordPress editor, the validation showed up just fine.
