Use the frm_password_checks filter to change the password strength rules of Password fields. Add, change, or remove the rules a password must pass, and the messages people see when it fails one.

The rules apply when a Password field has Require a strong password checked. They also set the list that Show password strength meter shows under the field.

Requirements

• Formidable Forms Pro, with a Password field in the form.

How it works

By default, a strong password needs 5 things. Each one is a rule in the filter's array, under its own key.

Formidable checks the rules in this order and shows the message of the first rule the password fails. The filter's rules are used in these places:

• Form submission: Formidable checks the password when the form is submitted. This happens only when the field has Require a strong password checked.
• JavaScript validation: When the form's Validate this form with javascript setting is on, the browser checks the same rules before the form is sent. It checks only fields with Require a strong password checked.
• Strength meter: The meter lists one line per rule, using each rule's label.
• Reset password page: The User Registration add-on checks a new password against the same rules on its reset password page. This happens only when a Reset Password Page is selected in Formidable → Global Settings → Registration. Learn how to create a reset password page.

Learn more about the password strength options.

Usage

add_filter( 'frm_password_checks', 'my_function_name', 10, 2 );

Parameters

• $checks (array): The password rules, keyed by rule name. Each rule is an array with these keys:
  • label (string): The line shown in the strength meter.
  • regex (string): A PHP regular expression the password must match, such as /^.{8,}$/.
  • message (string): The error shown when the password doesn't match.
• $args (array): Extra details.
  • field (object|array): The Password field. When Formidable builds the rules for JavaScript validation or the reset password page, this is a placeholder without an ID.

Write each regex between two single-character delimiters, such as /…/ or #…#, with no modifiers after the closing one. Formidable removes the first and last characters to reuse the rule in JavaScript. JavaScript validation can't use a rule with a modifier, such as /…/i. Each regex must also work in both PHP and JavaScript. PHP-only syntax, such as \A or \z, doesn't work in JavaScript validation.

Examples

add_filter( 'frm_password_checks', 'my_frm_password_min_length', 10, 2 );
function my_frm_password_min_length( $checks, $args ) {
	$checks['eight-char']['label']   = 'Twelve characters minimum';
	$checks['eight-char']['regex']   = '/^.{12,}$/';
	$checks['eight-char']['message'] = 'Passwords require at least 12 characters';
	return $checks;
}

add_filter( 'frm_password_checks', 'my_frm_password_no_special_char' );
function my_frm_password_no_special_char( $checks ) {
	unset( $checks['special-char'] );
	return $checks;
}

Limitations

• The check marks in the strength meter follow the 5 default rules. A changed rule keeps its default check. For example, with the 12-character example, the "Twelve characters minimum" line is checked at 8 characters. A rule with a new key always shows as not met in the meter. Form submission and JavaScript validation follow your rules.
• The rules sent to the browser for JavaScript validation are the same for every Password field. A change made only for one field, using $args['field'], isn't used by JavaScript validation.

Related developer hooks

• Turn off the password strength check on the User Registration reset password page with the frm_reg_password_strength_check hook.
• Add your own validation rules to any field with the frm_validate_field_entry hook.
• Change the show and hide password icons with the frm_pro_show_password_icons hook.

Related articles

• Password
• Create a WordPress Reset Password page
• How to Use Formidable Hooks