Change Password Strength Rules on LearnDash Registration

To change the LearnDash password strength rule on the registration form, filter learndash_min_password_strength (an integer from 0 to 4, default 3) and learndash_weak_password_stop_register (true or false, default true). Both are read by learndash_registerform_password_strength_data() and passed to LearnDash's strength meter script. Two limits matter before you rely on them: the check runs only in the browser, and on the Modern registration appearance the filters change the message but not which passwords are blocked. If the rule has to hold, add a server-side check as well.

This snippet guide shows both filters, explains what the numbers mean, and adds a server-side rule that applies whichever form appearance you use. Checked against the LearnDash 4.18.0.1 source (includes/payments/ld-login-registration-functions.php and assets/js/learndash-password-strength-meter.js) and the WordPress core strength meter, October 2026. LearnDash 5.x is current and the registration forms have changed in recent releases, so retest on your version.

How the LearnDash strength meter works

LearnDash does not score passwords itself. Its script calls WordPress's wp.passwordStrength.meter(), which runs the bundled zxcvbn library and returns a score:

zxcvbn also penalises words from the user's own inputs, such as the username and email, through wp.passwordStrength.userInputDisallowedList(). Below the meter, LearnDash prints a fixed hint: "Tip: Try at least 12 characters long containing letters, numbers, and special characters." The hint is advice; nothing checks length or character types.

Snippet 1: Require a Strong password

Put this in a small must-use plugin or a child theme's functions.php. It is not run on a live site; test on staging first.

<?php
/**
 * Require a zxcvbn score of 4 (Strong) on LearnDash registration.
 * Not run on a live site; test on staging first.
 */
add_filter( 'learndash_min_password_strength', 'aio_ld_min_password_strength' );
function aio_ld_min_password_strength( $strength ) {
	return 4;
}

Return 2 to accept Weak passwords, or 0 to show the meter without an error. Do not return more than 4: zxcvbn never scores higher, so every password would get the error. On the Classic appearance, a password scoring below the minimum gets " - Please enter a stronger password." after its label and the submit button is disabled.

Snippet 2: Show the meter but never block

<?php
// Keep the meter as guidance only. Not run on a live site; test on staging first.
add_filter( 'learndash_weak_password_stop_register', '__return_false' );

With this, the Classic form still shows the label and error text but leaves the submit button enabled. Use it when you enforce your own rule on the server and do not want two different messages fighting each other.

Classic vs Modern appearance: what the filters actually change

The registration form appearance is set under LearnDash LMS > Settings > Registration/Login, in the Appearance setting (Classic or Modern, added in 4.16.0). The two behave differently in 4.18.0.1:

So on Modern, a minimum of 4 still lets a Medium (3) password through, and a minimum of 1 still blocks a Weak (2) password. The Modern reset password form uses the same meter and the same rules. If you need a different threshold on Modern, the reliable place to enforce it is the server.

Also note the -1 case: if zxcvbn has not loaded when the user types, LearnDash does not disable the button. A browser with JavaScript turned off skips the meter entirely.

Snippet 3: Enforce a rule on the server

Both LearnDash forms on a single site post to wp-login.php?action=register, so WordPress runs the registration_errors filter, which LearnDash itself uses for its required-field checks. Hooking in at a later priority lets you reject passwords that break your policy, whatever happened in the browser:

<?php
/**
 * Server-side password rules for LearnDash registration forms.
 * Not run on a live site; test on staging first.
 */
add_filter( 'registration_errors', 'aio_ld_password_rules', 20 );
function aio_ld_password_rules( $errors ) {
	if ( ! isset( $_POST['ld_register_id'], $_POST['learndash-registration-form'], $_POST['password'] ) ) {
		return $errors; // Not a LearnDash registration.
	}

	$nonce = sanitize_text_field( wp_unslash( $_POST['learndash-registration-form'] ) );
	if ( ! wp_verify_nonce( $nonce, 'learndash-registration-form' ) ) {
		return $errors;
	}

	// Do not sanitise passwords; compare them as entered.
	$password = (string) wp_unslash( $_POST['password'] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput

	if ( '' === $password ) {
		return $errors; // LearnDash reports empty passwords itself.
	}

	if ( mb_strlen( $password ) < 12 ) {
		$errors->add( 'aio_password_length', esc_html__( 'Use a password of at least 12 characters.', 'aio' ) );
	}

	$email = isset( $_POST['user_email'] ) ? sanitize_email( wp_unslash( $_POST['user_email'] ) ) : '';
	$local = $email ? (string) strstr( $email, '@', true ) : '';
	if ( strlen( $local ) >= 4 && false !== stripos( $password, $local ) ) {
		$errors->add( 'aio_password_email', esc_html__( 'Your password must not contain your email name.', 'aio' ) );
	}

	return $errors;
}

A length rule works better than character-class rules: it is easy to explain, and it matches the hint LearnDash already shows. Keep the client meter for feedback and let the server decide. Multisite registrations go through wp-signup.php instead and need the multisite signup validation hooks.

Testing the change

1. Open the registration page in a private window and type password123. The meter should show Very weak or Weak.
2. Type a long passphrase and confirm the label reaches your minimum.
3. Submit a weak password with the meter bypassed (for example with JavaScript disabled) and confirm your server-side error appears.
4. Repeat on the other appearance if you might switch between Classic and Modern.

Password rules are one layer. Rate limiting and lockouts matter as much; see our LMS brute force protection guide and the secure coding checklist for WordPress LMS.

How we can help

We customise LearnDash registration, login and onboarding flows, including password policy, SSO and custom fields. See our LMS plugin development service or the LearnDash guide for the wider setup. LearnDash is a trademark of its owner; All-in-One LMS is an independent development company and is not affiliated with LearnDash.