Magento 2 Set Previous Password History

Question

I'm currently trying to make my website PCI DSS compliant and one of the requirements is to ensure that, when an administrator user selects a new password, it cannot be the same as any of the last four password that they have used.

Is there a way to set the number of stored passwords in Magento 2.2.7 so that it will not allow an admin user to use a password they have used previously?

Answer 1

I don't think Magento default has this feature to store the password history for frontend customer. Only it has for the admin user password change history.

First, you want then create a custom table with

And save and validate customer password at

Magento\Customer\Model\Customer\Attribute\Backend\Password class.

Answer 2

I'm answering late sorry, but it may be helpful for others. Magento has out of box feature to not allow any previously used passwords for admin users. Magento stores used passwords in table "admin_passwords" so you can find admin users all password history in it. screenshot:

So for backend users this feature is already available with Magento2. You can test it by edit user and try to update password with used passwords.

Thank you.