Registration: validate email and password strength before allowing submit #150

New Issue

2026-07-29T23:20:44Z

thatguygriff commented

2026-07-29 23:20:44 +00:00

Feedback

Ensure that the email and password fields during registration include validation of password strength and won't let you submit if they are bad

Wanted

Email — format validated client-side (type="email" plus an explicit check) and server-side with is_email(); reject an address already registered with a clear message.
Password — a strength requirement enforced on both sides, with inline feedback as the user types and the submit button blocked until it passes. Reuse WordPress's wp_password_change_notification era tooling where it fits: zxcvbn ships with WP core via the password-strength-meter script, so enqueue that rather than rolling a custom scorer.
Server-side rejection is mandatory — client-side blocking is UX, not enforcement.

Decisions to make

Minimum strength threshold (the WP meter's "medium"/"strong" bands) and minimum length.
Whether to also require a password confirmation field.

Places to touch

templates/frontend/register-page.php
assets/js/register.js — enqueue and wire password-strength-meter, gate the submit button
src/Auth/RegistrationPage.php — server-side validation and error surfacing
assets/css/frontend.css — strength meter styling
docs/features/account-registration.md
tests/Unit/Auth/RegistrationPageTest.php

## Feedback > Ensure that the email and password fields during registration include validation of password strength and won't let you submit if they are bad ## Wanted - **Email** — format validated client-side (`type="email"` plus an explicit check) and server-side with `is_email()`; reject an address already registered with a clear message. - **Password** — a strength requirement enforced on both sides, with inline feedback as the user types and the submit button blocked until it passes. Reuse WordPress's `wp_password_change_notification` era tooling where it fits: `zxcvbn` ships with WP core via the `password-strength-meter` script, so enqueue that rather than rolling a custom scorer. - Server-side rejection is mandatory — client-side blocking is UX, not enforcement. ## Decisions to make - Minimum strength threshold (the WP meter's "medium"/"strong" bands) and minimum length. - Whether to also require a password confirmation field. ## Places to touch - `templates/frontend/register-page.php` - `assets/js/register.js` — enqueue and wire `password-strength-meter`, gate the submit button - `src/Auth/RegistrationPage.php` — server-side validation and error surfacing - `assets/css/frontend.css` — strength meter styling - `docs/features/account-registration.md` - `tests/Unit/Auth/RegistrationPageTest.php`

thatguygriff added the bug label 2026-07-29 23:20:44 +00:00

thatguygriff referenced this issue from a commit

2026-07-30 01:13:33 +00:00

Validate signup email and password strength

thatguygriff referenced a pull request that will close this issue

2026-07-30 01:13:57 +00:00

Validate signup email and password strength #155

thatguygriff closed this issue

2026-07-30 01:27:05 +00:00

Sign in to join this conversation.