Weak administrator password check

The Weak Administrator Passwords card (Pro, Settings → Analysis) tests each Super User, Administrator and Manager account against a short list of the most common passwords. It runs on your own server and nothing leaves the site.

How it works

• Press Check now. Each comparison is slow by design, so accounts are checked in small batches and the message says how many are finished and how many are still to do.
• The result is a yes or no per account. The password itself is never stored or shown.
• Turn on Alert on: Weak administrator passwords under Alert rules to be e-mailed about a weak account.

A pass does not prove a password is strong. It only means it is not one of the very common ones. Use two-factor authentication for every privileged account.