In reply to Ryan Hellyer.

Unfortunately, you can't protect a user from themselves.

WordPress 3.7 included a smarter password meter (called zxcvbn) which uses a much better method of realistically providing users information about whether or not a password is any good.

But even if it "forced" users to select a strong password, that wouldn't help them. They'd just write it down on a post-it note on their monitor.

The truth is that passwords are terrible in the first place. Long term, we'd be well advised to making it easy for the code to support better ways in the future. Fortunately, it's already mostly there. Now we just need those better ways. 2FA is great, but not the end of the line, I feel.