このプラグインは WordPress の最新3回のメジャーリリースに対してテストされていません。もうメンテナンスやサポートがされていないかもしれず、最新バージョンの WordPress で使用した場合は互換性の問題が発生する可能性があります。

WP Modern Password Hashing

説明

For legacy support with a wider range of PHP versions, WordPress opts to use PHPASS (a portible password hashing library) which WordPress defaults to using a MD5 based hash.

The security of your password hashes can be improved by using a modern password hashing algorithm, such as BCRYPT for PHP 5.5+ or ARGON2I for PHP 7.2+

This plugin aims to improve the security of the hashed passwords by using PHP 5.5’s password_hash() function and the BCRYPT algorithm but also supports the newer ARGON2I algorithm.

For extended support when password_hash() is not available this plugin will fallback to using PHPASS with additional security when compared to the WordPress defaults.

インストール

  1. Upload the plugin folder to the /wp-content/plugins directory, or install the plugin through the WordPress plugins screen directly.
  2. Activate the plugin through the ‘Plugins’ screen in WordPress.
  3. User passwords will be rehashed on the next successful login.

FAQ

How do I use ARGON2I

Currently you will need to update the alorithm in ‘wp-modern-password-hashing.php’ line 18, from PASSWORD_BCRYPT to PASSWORD_ARGON2I
Keep in mind that updates will undo your change, I plan to add an options screen to wp-admin.

How do I use BCRYPT

If PHP 5.5 or higher is used, then password_hash() will be available, and the plugin will default to using it.

Can I change between ARGON2I and BCRYPT?

Provided you change the alorithm in ‘wp-modern-password-hashing.php’ line 18.
Keep in mind that updates will undo your change, I plan to add an options screen to wp-admin.

Yes, you should be able to change back and forth (Provided your PHP version is suffcient), as the password will be checked against the password_verify and password_needs_rehash functions.

What about Legacy support?

In cases where password_hash() is not available, PHPASS as included with WordPress will be used, but with two adjustments.
The rounds/iterations_count option and the use_md5/portable_hashes have been adjusted from the WordPress defaults of ‘8, true’ to ’16, false’
This should improve the security of the hashed passwords, for those who are running on older versions of PHP.

評価

このプラグインにはレビューがありません。

貢献者と開発者

WP Modern Password Hashing はオープンソースソフトウェアです。以下の人々がこのプラグインに貢献しています。

貢献者

“WP Modern Password Hashing” をあなたの言語に翻訳しましょう。

開発に興味がありますか ?

コードを閲覧するか、SVN リポジトリをチェックするか、開発ログRSS で購読してみてください。

変更履歴

1.0.1

  • Changed: Cases of array being shorthanded to [];, to array(); for improved compatibility.
  • Changed: Function comments.
  • Changed: Tags.
  • Added: A few comments to various bits of code/functions.
  • Added: Check for ‘$2y$’ in PHPASS section of wp_check_password(), to improve compatibility where password_verify() is not available.
  • Added: In cases where password_verify() is not available and password is prefixed with ‘$2y$’, rehash password back to PHPASS ‘$P$’ or ‘$2a$’
  • Added: Column to ‘All Users’ page, to display the detected algorithm of each user (MD5, $P$, $2a$, $2y$ and $argon2i$)

1.0.0

  • Initial release.