How do I prevent a user from re-using the same password within a certain period of time?

I have configured a number of password restriction modules {Password policy, Generate Password and Flood control} which I have configured to do things like "Password must not match any of the user's previous 10 passwords" but I can't configure them to prevent the same password from being reused within a certain period of time like a year.

I am using Drupal 7.

1 Answer 1


You are looking to alter Password policy module:

A password policy can be defined with a set of constraints which must be met before a user password change will be accepted. Each constraint has a parameter allowing for the minimum number of valid conditions which must be met before the constraint is satisfied.

Current constraints include:

  • History constraint (checks hashed password against a collection of users previous hashed passwords looking for recent duplicates)

Now, all you need is to take this constrain and make a copy based on time, not number. Should be pretty easy, real difference is in one WHERE condition.

If module provides hooks, make it in your custom module. If it does not, provide a patch with your constrain.

  • Minus the fact that it doesn't work. We've been trying to get something like this, and stumbled across the same module, and found that it's not actually saving anything to it's history table. After some additional research I found these bugs associated with it: <br> drupal.org/node/1653242 <br> drupal.org/node/1921356
    – user22930
    Oct 17, 2013 at 13:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.