Password Policy Manager

miniOrange Password Policy Manager for Magento helps store owners eliminate weak and reused passwords across their store by enforcing configurable password strength rules on every account creation, login, and password reset for both admin users and store customers with full visibility through flagged account tracking and audit logging.

The miniOrange Password Policy Manager for Magento/Adobe Commerce gives you a complete password governance layer inside your Magento admin, organized into four areas: Configuration, Password Policy Settings, User Management, and Reports.

The Configuration module is where you choose who the policy applies to. Select Admin to govern backend users, or Customer to govern storefront shoppers. For the selected user type, you control enforcement independently across three flows: Account creation, Login, and Forgot / reset password. Each flow has its own on/off toggle, its own weak password behaviour, and its own admin defined error message. 

Password Policy Settings define the rules themselves in a single place. Choose which character classes a password must include uppercase letter, lowercase letter, number, and special character and block passwords that contain the account's own email local-part, a common source of easily guessed credentials. 

Because enforcement runs at login and not just at signup, existing accounts with weak passwords are caught too. When an account fails the policy, it is flagged and surfaced in User Management, where you get a searchable table of flagged accounts showing the user type, email, the event that triggered the flag, 

Account & Pricing

You do not need to create an account or register with miniOrange to use our free version.

If you face any issues while setting up this extension, please contact us at magentosupport@xecurify.com

To use extensions' premium features, you can upgrade to our premium plans.

Features

• Admin Password Policy Enforcement – Enforce password rules on admin account creation, admin login, and admin forgot / reset password.
• Customer Password Policy Enforcement – Extend the same enforcement to store customers on account creation, login, and forgot / reset password.
• Centralized Password Requirements – Define one set of password rules that applies to every enabled flow, instead of maintaining separate rules per flow.
• Character Class Enforcement – Require uppercase letters, lowercase letters, numbers, and special characters in any combination you choose.
• Email-in-Password Blocking – Block passwords that contain the account email's local-part to stop predictable, easily guessed credentials.
• Per-Flow Enforcement Toggles – Switch enforcement on or off independently for account creation, login, and forgot / reset password.
• Configurable Weak-Password Behaviour – Decide what happens when a password fails the policy on each flow, including blocking the weak password outright.
• Custom Error Messaging – Write your own error message for each flow so the guidance a user sees matches the exact context they are in.
• Enforcement at Login, Not Just Signup – Catch pre-existing weak passwords on accounts created before the policy was introduced.
• Flagged Accounts Dashboard – View every account that failed the policy, with type, email, triggering event, flagged date, and grace status in one searchable table.
• Audit Logging – Record every policy event with date, event, type, email, result, and message for security review and internal compliance evidence.

Custom feature requirements

If you want any custom changes or features in this extension, let us know your requirement on magentosupport@xecurify.com and we will add that feature in the extension for you.

Dependencies

NONE

24/7 Support

In case you face any issues or if you have any questions, please feel free to reach out to us on our 24*7 active support at magentosupport@xecurify.com or Contact us.

Website

Check out our website for other extensions from the link here or visit https://commercemarketplace.adobe.com/partner/miniOrange_inc to see all our listed Magento extensions. For more support or info email us at magentosupport@xecurify.com. You can also submit your query from the extension's configuration page.