Este plugin no se ha probado con las últimas 3 versiones mayores de WordPress. Puede que ya no tenga soporte ni lo mantenga nadie, o puede que tenga problemas de compatibilidad cuando se usa con las versiones más recientes de WordPress.

WP Modern Password Hashing

Descripción

For legacy support with a wider range of PHP versions, WordPress opts to use PHPASS (a portible password hashing library) which WordPress defaults to using a MD5 based hash.

The security of your password hashes can be improved by using a modern password hashing algorithm, such as BCRYPT for PHP 5.5+ or ARGON2I for PHP 7.2+

This plugin aims to improve the security of the hashed passwords by using PHP 5.5’s password_hash() function and the BCRYPT algorithm but also supports the newer ARGON2I algorithm.

For extended support when password_hash() is not available this plugin will fallback to using PHPASS with additional security when compared to the WordPress defaults.

Instalación

  1. Upload the plugin folder to the /wp-content/plugins directory, or install the plugin through the WordPress plugins screen directly.
  2. Activate the plugin through the ‘Plugins’ screen in WordPress.
  3. User passwords will be rehashed on the next successful login.

Preguntas frecuentes

How do I use ARGON2I

Currently you will need to update the alorithm in ‘wp-modern-password-hashing.php’ line 18, from PASSWORD_BCRYPT to PASSWORD_ARGON2I
Keep in mind that updates will undo your change, I plan to add an options screen to wp-admin.

How do I use BCRYPT

If PHP 5.5 or higher is used, then password_hash() will be available, and the plugin will default to using it.

Can I change between ARGON2I and BCRYPT?

Provided you change the alorithm in ‘wp-modern-password-hashing.php’ line 18.
Keep in mind that updates will undo your change, I plan to add an options screen to wp-admin.

Yes, you should be able to change back and forth (Provided your PHP version is suffcient), as the password will be checked against the password_verify and password_needs_rehash functions.

What about Legacy support?

In cases where password_hash() is not available, PHPASS as included with WordPress will be used, but with two adjustments.
The rounds/iterations_count option and the use_md5/portable_hashes have been adjusted from the WordPress defaults of ‘8, true’ to ’16, false’
This should improve the security of the hashed passwords, for those who are running on older versions of PHP.

Reseñas

No hay reseñas para este plugin.

Colaboradores y desarrolladores

«WP Modern Password Hashing» es un software de código abierto. Las siguientes personas han colaborado con este plugin.

Colaboradores

Traduce «WP Modern Password Hashing» a tu idioma.

¿Interesado en el desarrollo?

Revisa el código , echa un vistazo al repositorio SVN o suscríbete al registro de desarrollo por RSS.

Registro de cambios

1.0.1

  • Changed: Cases of array being shorthanded to [];, to array(); for improved compatibility.
  • Changed: Function comments.
  • Changed: Tags.
  • Added: A few comments to various bits of code/functions.
  • Added: Check for ‘$2y$’ in PHPASS section of wp_check_password(), to improve compatibility where password_verify() is not available.
  • Added: In cases where password_verify() is not available and password is prefixed with ‘$2y$’, rehash password back to PHPASS ‘$P$’ or ‘$2a$’
  • Added: Column to ‘All Users’ page, to display the detected algorithm of each user (MD5, $P$, $2a$, $2y$ and $argon2i$)

1.0.0

  • Initial release.