I'm currently trying to make my website PCI DSS compliant and one of the requirements is to ensure that, when an administrator user selects a new password, it cannot be the same as any of the last four password that they have used.

Is there a way to set the number of stored passwords in Magento 2.2.7 so that it will not allow an admin user to use a password they have used previously?

1 Answer 1


I don't think Magento default has this feature to store the password history for frontend customer. Only it has for the admin user password change history.

First, you want then create a custom table with

And save and validate customer password at

Magento\Customer\Model\Customer\Attribute\Backend\Password class.

  • Thanks, I'm only really looking for the Admin password history anyway. Changing the customer password history is not necessary.
    – CJNotts
    Jun 3, 2019 at 8:07
  • That class is responsible for saving the password. So you want custom module and save password old password then you have work on this class.
    – Amit Bera
    Jun 3, 2019 at 8:10
  • I may be misunderstanding this but The class you've specified here seems to be for the customer password. I only need to save the last 4 instances of the Admin password. The customer ones are fine.
    – CJNotts
    Jun 3, 2019 at 8:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.