Checking the Password Strength of WordPress Users with WPScan

There are many things you can do to keep your WordPress website secure. Some examples would be keeping plugins and themes up-to-date or implementing a firewall on your site.

However, if you have weak passwords and bad login security, it’s not going to do much to prevent bad actors from gaining access to your site.

Users aren’t generally fans of strong passwords and often default to simple passwords or passwords they use elsewhere already.

One step you can take is to enforce the use of strong passwords using a password policy plugin like our very own Melapress Login Security. However, it’s still a good idea to regularly audit the password strength of user accounts on your WordPress website. Once you have identified users who are using weak passwords, you can ask them to reset their passwords.

In this guide, we will provide step-by-step instructions on how to check the password strength of WordPress users with WPScan.

What is WPScan and how does it work?

WPScan is a popular, free, and open-source command line tool that helps people identify vulnerabilities in their WordPress sites.

It works by actively scanning the WordPress site to find information like the WordPress version, active plugins and themes, usernames, and so on. Let’s see how WPScan does this:

Find WordPress version

Determining the installed WordPress version on a website is important because vulnerabilities are usually version-specific.

One of the ways WPScan determines the WordPress version on your website is by looking at the Etag HTTP response header for the /wp-admin/load-styles.php file.

In our case, the WordPress version is 6.4.3, which is the latest version at the time of the scan.

List active plugins and themes

Website plugins and themes can also have vulnerabilities.

WPScan tries to identify the active theme as well as the installed plugins on a site using plugin enumeration.

If the installed versions of any themes and plugins have known vulnerabilities, attackers could gain access to sensitive information or do other damage. For example, a vulnerability in the Elementor Pro plugin versions up to 3.11.6 that allowed authenticated users with subscriber-level capabilities to update arbitrary site options.

WPScan maintains an up-to-date database on known vulnerabilities in the WordPress core, plugins, and themes. If WP Scan finds a vulnerable theme or plugin, it will list it here.

Enumerate users

You can also use WPScan to enumerate users. User enumeration will help WPScan find the usernames of registered accounts. A bad actor can use this list of usernames as part of a larger attack. For instance, they could try to crack the passwords of these accounts through brute-force attacks.

Let’s understand how WPScan does this.

You can easily view all posts associated with a particular author on a WordPress site if you know their username. All you need to do is visit the URL http://domain.com/author/nitish.

Here, “nitish” is the username of the author whose posts you want to see.

If you don’t know the username for an author, you can also use their user ID to see all the posts they have published.

For instance, if the author with username “nitish” has user ID 5, WordPress will redirect the URL http://domain.com/?author=5 to http://domain.com/author/nitish.

As you can see, enumerating over user IDs one at a time will give WPScan the username of the corresponding accounts.

There is one more problem.

The redirection from http://domain.com/?author=5  to http://domain.com/author/nitish will happen whether “nitish” is an actual author or not. This means that this technique will also expose the usernames of accounts that aren’t even authors.

Bad actors could use this technique to get the username of all accounts.

Brute-force attacks to determine passwords

In the previous section, we discussed how WPScan can try to determine the username of different WordPress accounts.

These exposed usernames aren’t a threat by themselves. However, bad actors could attempt to crack the passwords of these accounts using brute-force attacks.

Basic brute force attacks are comparatively inefficient and take way too long to crack passwords to be practical. So, attackers usually opt for a type of brute force attack that yields better results, like a dictionary attack.

A dictionary attack is usually as simple as an attacker trying a list of common passwords against a username. If they are lucky, they’ll hit the right one and be allowed in.

If the user accounts aren’t protected by strong passwords, bad actors could potentially gain access to them.

Luckily, you can use WPScan to simulate brute-force attacks on your website and potentially get to know these weak passwords before bad actors do.

You can use it to simulate brute-force dictionary attacks on your website and expose weak passwords.

How to check password strength using WPScan

We will now discuss how you can check the password strength of various user accounts by executing brute-force dictionary attacks through WPScan.

Get a password file

WPScan requires us to pass a file that contains the list of passwords that it should go through to gain access to user accounts.

Instead of creating a list of random passwords ourselves, we will directly take one available on the internet. Attackers have a lot of such password lists available at their disposal as a result of all the data breaches major websites have faced over the years. For instance, 15 million customer records were exposed in a data breach on 000webhost.

We will be using a list of passwords from the SecLists repository on GitHub. The repository has several password files available for you to use.For our example, we will be using the Lizard-Squad.txt password dictionary file. This file has a list of around 12,000 commonly used passwords.

Audit the password strength of a single user

We can simulate a brute force attack to check password strength using WPScan by executing the following command in the terminal:

wpscan --url http://domain.com --passwords PASSWORD_FILE_PATH --usernames COMMA,SEPARATED,USERNAME,LIST

This command has three parameters.

1: –url: This parameter specifies the website URL where we want to execute our brute force attacks.

2: –passwords: This parameter specifies our password dictionary file´s path. This is a text file that contains each password on a separate line.

3: –usernames: We can use this parameter to provide a comma-separated list of usernames whose passwords we want to brute force.

In our case, the exact WPScan command for the brute force attack would be:

wpscan --url http://localhost/nit-wordpress/ --passwords Lizard-Squad.txt --usernames gary

We are using WPScan to brute force the password of only a single user here. You might recall that we were able to get the username “gary” after doing user enumeration with WPScan.

Even if the password file contains a valid password, it can take a while for WPScan to find it.

Here is what our terminal should look like after a successful brute-force attack.

It took WPScan around 3 minutes to successfully guess the login password. As you can see, WPScan had to try 810 passwords from around 12,000 listed in the password file.

Audit the password strength of multiple users

As we mentioned in the previous section, WPScan allows you to run brute-force attacks against multiple user accounts at once. All you need to do is supply a comma-separated list of usernames.

Here is an example:

wpscan --url http://localhost/nit-wordpress/ --passwords Lizard-Squad.txt --usernames amanda,billy,paul

Executing the above command in the terminal gave us the following output.

For this demonstration, we have intentionally created dummy accounts with weak/common passwords so that WPScan could crack them fairly quickly. Auditing the password strength of your website’s user accounts will likely take longer.

Speed up the password scan

How long it takes to crack passwords depends on a few factors.

If the password is present somewhere near the beginning of the password file, cracking it will only take a couple of minutes. However, the time taken to successfully crack an account password can increase significantly if the password file is large and the correct password is present near the end.

One way to speed up this process is to increase the number of requests that WPScan makes at a time.

By default, WPScan makes 5 requests at a time. You can increase the number of requests to up to 50 by using the –max-threads parameter.

Here is an example of a WPScan command that executes 50 threads at a time:

wpscan –url http://localhost/nit-wordpress/ –passwords Lizard-Squad.txt –usernames gary –max-threads 50

There are two important things you should keep in mind when increasing the number of threads:

1: Increasing the number of threads only speeds up the process if the server is fast enough to process this many threads.

2: Executing 50 threads at a time could also strain the server if it doesn’t have enough resources.

How to ensure users are using strong passwords?

We have just seen in the previous section how WPScan can crack user passwords.

This poses a threat to website security because it allows bad actors to potentially gain access to admin accounts with weak passwords.

One way to combat the problem of weak passwords is to enforce a strong WordPress password policy using the MelaPress Login Security plugin.

Enforce strong passwords

Melapress Login Security allows you to enforce strong password policies such as setting a minimum character length for the passwords, mixing lowercase, uppercase, and numeric characters, and including special characters.

Set login & user security policies such as limit login attempts, login page hardening, and much more.

Get Melapress Login Security

Recommend password managers to users

Users will find strong passwords hard to remember. Using a password manager will help users easily manage their login credentials across multiple websites.

A password manager will securely store and manage user credentials without them having to remember all their passwords. All they need is a single master password.

1Password and KeePass are some popular examples of password managers.

You should encourage your users to use password managers to easily manage their account credentials across several websites.

Enforce login policies

Another way to reduce the threat from brute force attacks is to limit login attempts. MelaPress Login Security allows you to lock user accounts after a user enters an incorrect password a specific number of times.

You can also specify a cooling period after which the count of failed login attempts resets.

Configure password policies per role

WordPress allows user accounts to have different roles like Administrator, Editor, and Subscriber among others. Different user roles have different levels of access. The level of access determines what they can do on a website.

In general, a user account with more permissions has the potential to do more damage if compromised. Therefore, you should consider configuring your password policy based on user roles.

Luckily, MelaPress Login Security allows you to configure password policy rules based on user roles. You can set a different value for the password length, required characters, and an expiration date for the passwords among other things.

This way, users who don’t have extensive permissions can have somewhat lax password requirements.

Change the default WordPress login URL

Automated attacks usually work under the assumption that a website is using the default WordPress login page to authenticate users. To provide an additional layer of security, you can use the MelaPress Login Security plugin to let users log in through a different page.

Implement 2FA for better security

Enforcing strong password and login policies on your website, and doing a password audit regularly will significantly reduce the chances of a bad actor cracking user account passwords. 

But there is more you can do.

Bad actors may try to steal user credentials using phishing attacks instead of brute forcing them.

In a phishing attack, the hackers try to get users to reveal their account credentials by pretending to be an authority figure. They could send an email that asks for such information or create a similar looking website where users would be asked to log in. This fake website will store this login data and use it on the actual website.

Using two-factor authentication, also called 2FA,  will help protect user accounts from unauthorized access even if their credentials are stolen.

This is because anyone trying to log in will have to authenticate the request using another authentication factor such as an OTP received through email or SMS.You can use the WP 2FA plugin to set up two-factor authentication on your WordPress website.

Add two-factor authentication and increase security with multiple methods to choose from.

Get WP 2FA

Make 2FA Setup process frictionless

2FA, without doubt, boosts user account security. However, users might be reluctant to set up 2Fa on their accounts.

This is because two factor authentication adds an extra step to the login process. Usually, it also requires access to another device where users will receive a code to authenticate themselves.

There are a few steps that you can take to make 2FA as convenient for users as possible without compromising security.

Let users choose from multiple 2FA methods

Users will likely have different preferences when it comes to the mode of 2FA authentication. It is a good idea to give them the option to choose from multiple 2FA methods.

Let users add trusted devices

If users regularly logs into their account using the same device, letting them add it as a trusted device would significantly boost convenience without compromising too much with security.

This is because a bad actor is less likely to use the same device as a legitimate user to log into their account.

You could set some conditions like how long a device should be trusted and when it should prompt users for a 2FA code again in order to improve security.

Provide backup authentication methods

People usually receive authentication codes on their smartphones either through apps, push notifications, or SMS.

However, they might not always have their phone with them, or their phone might have run out of battery.

You should consider providing some secondary backup methods that users can set up in advance to authenticate themselves in such situations.

Conclusion

In this article, we discussed how you can audit the password strength of different user accounts on your website using WPScan.

Once you find an account using weak passwords, alerting the user and encouraging them to use strong passwords is a good idea.

You should also take some other steps like enforcing strong password policies to reduce their likelihood of using weak passwords.

Finally, implementing 2FA will ensure that users’ accounts stay secure even if their credentials get compromised.