Passwords

This page explains how passwords work in Chinaski: the rules they must follow, how to change or reset them, how expiry and lockout behave, and how administrators manage passwords for other users.

Password requirements

Passwords are stored securely and are never visible to anyone, including administrators.

When you create or change a password, it must meet all of these rules:

At least 8 characters long
At least one uppercase letter
At least one lowercase letter
At least one digit

A stricter rule applies when the site’s first administrator password is set, either during the browser setup screen or from the command line: that password must be at least 12 characters long, in addition to the rules above.

If your password doesn’t meet these requirements, the form tells you exactly which rule failed.

Changing your own password

You can change your password on your account page.

Enter your current password.
Enter the new password twice to confirm it.
Save.

A few things happen when the change succeeds:

All of your other sessions are signed out immediately. The device you changed it from stays signed in.
The password expiry clock restarts from the moment of the change.
If your password had been flagged as expired, that flag is cleared.

If the current password is wrong or the new passwords don’t match, nothing is changed and you’re shown an error.

Password expiry

A site administrator can require users to change their passwords periodically. This is controlled by the Password expiry setting on the Settings → Security tab, measured in days. It is switched off by default (set to 0).

When expiry is enabled and your password reaches its age limit:

The next time you sign in, you’ll see “Your password has expired. Please change it now.” and you’ll be taken straight to your account page to change it.
Your account page also shows a warning while your password is still valid but nearing expiry: “Password expires in N day(s).” appears when 7 days or fewer remain.

Changing your password resets the countdown.

Resetting a forgotten password

If you’ve forgotten your password:

Open the “Forgot password” page and enter your username or email address.
If the account exists and has an email address on file, a reset link is sent to that address.
Open the link and set a new password, then sign in.

Useful things to know about reset links:

A link is valid for 24 hours.
A link can only be used once. After a successful reset it stops working.
Requesting a new reset cancels any earlier link for your account.
After you reset your password, you are signed out of all sessions: every signed-in device will need to sign in again.
The form always shows the same confirmation whether or not the account exists, so it can’t be used to find out who has an account.

Account lockout

To protect against guessing, sign-in attempts are limited by IP address. Repeated failures escalate:

5 failed attempts → locked out for 1 minute
10 failed attempts → locked out for 5 minutes
20 failed attempts → locked out for 30 minutes

If you stop trying for roughly 10 minutes, the count of failed attempts starts over. During a lockout, even correct credentials are rejected until the wait is over, and the sign-in page tells you to try again later.

Setting up users and passwords as an administrator

Administrators manage other users’ passwords from the user’s edit screen in the admin area:

Enter a new password (twice) to set or reset that user’s password. The user is signed out of all their sessions afterwards, and the change is recorded.
Leave both password fields blank to update the user’s role, email, or profile details without touching their password.
Any password you set must meet the standard requirements listed above.

One safeguard: if you are the only active administrator, you cannot demote your own account from admin to editor. Attempting to do so shows an error, because it would lock everyone out of user management.

New accounts created through the self-registration page are given the editor role, and the same password requirements apply. Registration attempts are rate-limited per IP address like sign-in.

First-run setup

On a fresh site, the first administrator’s password is chosen on the setup screen, which requires the stricter 12-character minimum plus the standard rules. The setup screen is only available until setup is completed; once the first password has been set, it is no longer available.

If an administrator loses their password and no other admin is available, an operator with command-line access to the server can put the site back into first-run setup mode so a new password can be chosen through the same setup screen.

Password-protected pages

In addition to user accounts, individual pages and posts can be given their own password in the content editor. Visitors must enter that password to see the content.

One thing to be aware of: this protection is a reader-facing gate, not removal of the content from the page. The theme you use must explicitly support the password gate; if it doesn’t, setting a password on a page will have no visible effect, with no warning shown to you or the administrator.