Improve your WP Admin password security with Account Protection

Weak and compromised credentials are among the leading causes of site breaches and malware infections. Jetpack and Jetpack Protect enhance your site’s security by strengthening password management. We perform advanced checks to detect compromised passwords and enforce additional verification when necessary.

Note: Account Protection is different from Jetpack’s Brute Force Protection feature.
Brute Force Protection helps prevent repeated login attempts from unknown IPs. You can turn it on or off with “Block repeated failed login attempts” at Jetpack → Protect → Settings in WP Admin.
Account Protection, on the other hand, is triggered when a user attempts to log in with a password that has been compromised in a known data breach.
If the user is locked out and cannot receive the verification code, the feature cannot be disabled from WP Admin and may require manual recovery.

RequirementsMD

Jetpack Account Protection requires either the Jetpack plugin (version 14.5 or higher) or the Jetpack Protect plugin (version 4.1 or higher) along with the site connection. If you have both the Jetpack and Jetpack Protect plugins, you must upgrade them to at least versions 14.5 and 4.1, respectively.

Account Protection is free and does not require a Jetpack plan. It is off by default on sites that connect Jetpack for the first time, so turn it on after you connect. See Manage Account Protection activation.

How Account Protection worksMD

Manage Account Protection activationMD

Starting with Jetpack 16.4, Jetpack does not turn on Account Protection when you connect a site for the first time. Turn it on with the steps below. If Account Protection was already on before you updated, it stays on, and you do not need to do anything.

Account Protection also stays off after you upgrade from a Jetpack version earlier than 14.5, or after you reset your Jetpack modules.

To turn Account Protection on or off:

• If you have the Jetpack plugin active, and the Jetpack Protect plugin is not active:
  1. Go to Jetpack → Protect in WP Admin and click the Settings tab.
  2. In the Login protection section, under Account protection, turn the “Protect accounts with weak or leaked passwords” toggle on or off.
• If you have the Jetpack Protect plugin active:
  1. Go to Jetpack → Protect in WP Admin.
  2. Click the Settings tab.
  3. Turn the Account Protection toggle on or off.

On Jetpack versions before 16.4, go to Jetpack → Settings → Security, find the Account Protection section, and turn the “Protect your site with advanced password detection and profile management protection” toggle on or off.

If the setting is disabled and you can’t turn it on, see the Unsupported environments section of this page.

Add extra security checks when saving a passwordMD

Jetpack Account Protection performs additional security checks whenever a user sets or updates their password.

Passwords are evaluated against the following additional criteria:

• Must not contain a backslash character.
• Must be between 6 and 150 characters.
• Must not appear in known data breaches. Attackers frequently use passwords leaked in public breaches to gain unauthorized access.

When you update your password in WP Admin → Users → Profile, we perform additional checks to ensure security:

• The password must not match any part of your user data (e.g., display name, username, first or last name, email address, or nickname). Using a password similar to your personal details makes guessing easier for attackers.
• The password must not be identical to a previously used password. Reusing old passwords increases security risks.

Prevent unverified logins from using leaked passwords MD

Account Protection adds an extra layer of security to the login process.

We automatically check passwords against a database of known breaches for users with the role of Author or higher. If a compromised password is detected, an additional verification step is required. Once Account Protection is on, this check runs automatically, with nothing else to configure. Here’s how it works:

1. A WP Admin user attempts to log in, and Jetpack detects that their password has been compromised.
2. A 6-digit verification code is sent to the user’s email address.
3. The user sees a Verify Your Identity form, where they must enter the verification code. They can also request resending a new code if needed.
4. Once the code is submitted, the user is prompted to either Create a New Password (recommended) or Proceed Without Updating.

Recover your account in case of issues with the verification code deliveryMD

We send the verification code to the email address associated with your WP Admin user profile.

If you don’t receive your verification code, here’s what you can do:

If you have access to the mailbox:

• Try to resend the code. You can resend it three times per session. You should be able to make subsequent attempts every 15 minutes.
• If you still haven’t received the code, you can reset your current password. Once you update your password to a strong, uncompromised one, you will no longer be blocked by our Account Protection.

If you no longer have access to that mailbox:

1. Contact support. We will work with you to confirm your ownership of the site. We will then deactivate the Account Protection module for you.
2. After regaining access to your WP Admin, access your user profile at https://yourjetpack.blog/wp-admin/profile.php where yourjetpack.blog is your site’s domain. Once there, you will need to:
   • Update the Email field with your current email address.
   • Update the Password field with a strong, uncompromised password.

If we cannot confirm that you own the site:

We can only deactivate Account Protection for the owner of the site’s Jetpack connection. If you contact us from an email address that is not the connection owner’s, we cannot verify your ownership, and we cannot deactivate Account Protection for you. In this case, remove the Jetpack plugin from your site’s files to regain access.

Your hosting provider can help you remove the Jetpack plugin from your web server or you can follow these instructions:

1. Connect to your site using FTP, SFTP, or SSH. You can use these instructions to locate your credentials.
2. Delete the wp-content/plugins/jetpack folder. This deactivates Jetpack, including Account Protection. Your Jetpack settings are stored on our servers, so deleting the plugin folder does not delete them.
3. Log in to WP Admin.
4. Go to your user profile at https://yourjetpack.blog/wp-admin/profile.php, where yourjetpack.blog is your site’s domain.
5. Update the Email field with your current email address.
6. Update the Password field with a strong, uncompromised password.
7. Go to Plugins → Add Plugin in WP Admin, install Jetpack again, and reconnect it to your WordPress.com account.

Account Protection stays active after you reinstall Jetpack. Because you set a strong, uncompromised password in step 6, it will not ask you to verify your identity again.

Unsupported environmentsMD

The Jetpack Account Protection feature can be disabled by your hosting provider to avoid conflicts with platform-specific security solutions. Your site administrator can also manually disable it in the wp-config.php file:

define( 'DISABLE_JETPACK_ACCOUNT_PROTECTION', true );

In such cases, you will not be able to activate Account Protection. Instead, you will see a notice stating that this feature is disabled by your site administrator or hosting provider.

Risks of using a weak passwordMD

As a WordPress Administrator, your password is the first line of defense against unauthorized access. A weak password can put your entire site at risk. Here’s why strong password security is essential:

• Easy Target for Attackers: Weak passwords make your site vulnerable to brute-force attacks, where hackers systematically guess passwords to gain access.
• Higher Risk of Credential Theft: If you reuse passwords across multiple sites, a breach on another platform could expose your WP Admin account to attackers.
• Loss of Administrative Control: Attackers can make unauthorized changes, delete content, or insert malicious code.
• User and Data Breach Risks: Attackers with admin access can steal user information, including emails and personal details, putting your visitors at risk.
• SEO and Reputation Damage: If your site is hacked, search engines may flag it as unsafe, leading to lower search rankings and loss of visitor trust.
• Time-Consuming Recovery Process: Regaining control over a hacked site requires resetting credentials, restoring backups, and securing vulnerabilities—all of which take time and effort.
• Potential Legal and Compliance Issues: Depending on your industry, a security breach could result in legal consequences, including fines for failing to protect user data.
• Financial Losses: A compromised site can lead to lost revenue, particularly for WooCommerce businesses, membership sites, or any site that relies on visitor engagement.

PrivacyMD

Account Protection is deactivated by default. Check Manage Account Protection activation to learn how to activate it.