WordPress Security Optimization – Using Modern Password Hashing Algorithms

For historical reasons, WordPress still uses salted MD5 as its password hashing algorithm to this day. Under the threat of modern supercomputers and similar technologies, if you have higher security requirements, you should use more modern hashing methods.

Starting from PHP 5.5+, PHP has a built-in password_hash function for calculating password hashes. This function uses sufficiently strong hashing algorithms and is updated to keep pace with the times, and PHP officially recommends that all developers use this function instead of any other password hashing methods.

In WordPress, you can use the plugin: PHP Native password hash to achieve this. After installing and activating the plugin, it will automatically use password_hash as the default password hashing function and gradually replace the existing hashes in the user table.

1 Like

Will this slow down WordPress? Will anything abnormal occur after uninstalling the plugin?

No. If you uninstall this plugin, all users who have logged in since you started using this plugin will need to reset their passwords before they can log in.