Year after year we are forced to use ever more complex passwords. What I don't understand is: if you have a site, WordPress or otherwise, that doesn't allow infinite login attempts, why isn't even a "moderately good" password good enough? Granted using the name of your pet or a candy bar is a bad idea.

It seems to me that passwords are at greater risk from phishing, bulk theft from an online platform, etc. And password strength doesn't help in those circumstances.

It's true that WP sites do get an insane # of login attacks every day. And most of them are against the account "admin". Those "dumb bots" are a reminder that they'll be getting smarter and moving from "admin" to real user names soon enough. But again, if login attempts are limited, I don't see the risk.

I use the "Limit Login Attempts" plugin that Johan Eenfeldt was kind enough to write. And which Softaculous makes easy to add to every cPanel WP install. The default is 4 login attempts before lockout. I work with plenty of authors, and myself included, who can easily blow through that many attempts before figuring out what they're doing wrong, so I change that to 20. When a red bar is telling you you've only got 1 or 2 attempts left to access your site, it's stress that I don't believe the WP experience needs. 20 gives the author a little more room to relax, and as long as your password isn't as simple as an all lowercase "word" like "peanut", the bots will still never have anywhere near enough attempts to crack it.