# Block Common and Guessable Passwords

> Rejects the most common passwords, and passwords containing the username or site name, when users set or reset their password.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: security, passwords, users
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/block-common-passwords/

## Code

```php
$wpide_common_passwords = array(
    '123456', '1234567', '12345678', '123456789', '1234567890', 'password', 'password1', 'password123', 'qwerty', 'qwerty123',
    'abc123', '111111', '000000', 'iloveyou', 'letmein', 'welcome', 'welcome1', 'admin', 'admin123', 'monkey',
    'dragon', 'sunshine', 'football', 'baseball', 'master', 'login', 'princess', 'starwars', 'passw0rd', 'trustno1',
);

$wpide_password_problem = function ( $password, $username ) use ( $wpide_common_passwords ) {
    $lower = strtolower( (string) $password );

    if ( '' === $lower ) {
        return '';
    }

    if ( in_array( $lower, $wpide_common_passwords, true ) ) {
        return 'This password is one of the most common ones. Please choose something less predictable.';
    }

    foreach ( array( $username, get_bloginfo( 'name' ) ) as $word ) {
        $word = strtolower( trim( (string) $word ) );
        if ( strlen( $word ) >= 3 && false !== strpos( $lower, $word ) ) {
            return 'Your password must not contain your username or the site name.';
        }
    }

    return '';
};

add_action( 'user_profile_update_errors', function ( $errors, $update, $user ) use ( $wpide_password_problem ) {
    if ( ! empty( $user->user_pass ) ) {
        $problem = $wpide_password_problem( $user->user_pass, isset( $user->user_login ) ? $user->user_login : '' );
        if ( $problem ) {
            $errors->add( 'wpide_weak_password', '<strong>Error:</strong> ' . esc_html( $problem ) );
        }
    }
}, 10, 3 );

add_action( 'validate_password_reset', function ( $errors, $user ) use ( $wpide_password_problem ) {
    if ( ! empty( $_POST['pass1'] ) && $user instanceof WP_User ) {
        $problem = $wpide_password_problem( wp_unslash( $_POST['pass1'] ), $user->user_login );
        if ( $problem ) {
            $errors->add( 'wpide_weak_password', '<strong>Error:</strong> ' . esc_html( $problem ) );
        }
    }
}, 10, 2 );
```

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Block Common and Guessable Passwords" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/