Password field blocks pasting or password managers

Why does it matter?

Many people cannot remember or retype a strong password — because of memory, dyslexia or motor impairments — and rely on a password manager or copy and paste. A password field that blocks both turns signing in into a memory test, which WCAG 2.2 does not allow.

Who it affects: Screen reader users, voice-control users who say a field's label to move to it, and people with memory or attention difficulties who lose a placeholder once they type.

What does Lumtera flag?

Visible password fields with an inline onpaste or ondrop handler that returns false or calls preventDefault (an error), and password fields set to autocomplete="off", which asks browsers and password managers not to fill them in (a warning). Blocking added from a separate JavaScript file cannot be seen in the content.

Check ID password-paste-blocked — use it to filter the content report or with wp lumtera issues --rule.

How do I fix it in WordPress?

Remove the onpaste (or oncopy/ondrop) handler that stops pasting, and replace autocomplete="off" with autocomplete="current-password" on sign-in forms or autocomplete="new-password" on registration and reset forms. Visitors can then paste or let their password manager fill in the field.

Example

<input type="password" name="pwd" autocomplete="off" onpaste="return false">

<input type="password" name="pwd" autocomplete="current-password">

How do I check the fix?

1. Update the post. The issue disappears from the Lumtera Accessibility sidebar on the next check, and from the site report on the next scan.
2. Click each field's label: the cursor should move into the field. With a screen reader, each field should announce its label when it receives focus.