Question

In the first block, I make sure the password does not contain ‘password’. It works perfectly.

  var element=document.getElementById('password');
  if (element.value.toLowerCase().indexOf('password') > -1){ //returns 0 or more if present
    alert('Password may not contain the word `password`.');
    element.focus();
    return false;
  }

In the second block I check that the password does not containthe firstname, it does not work, what have I done wrong?

  //stop password of firstname
  var element=document.getElementById('password');
  var firstname=document.getElementById('firstname');
  if (element.value.toLowerCase().indexOf(firstname.value) > -1){ //returns 0 or more if present
    alert('Password may not contain the firstname.');
    element.focus();
    return false;
  }

Answer 1

You forgot to lowercase the first name:

// stop password of firstname
var element = document.getElementById('password');
var firstname = document.getElementById('firstname');
if(element.value.toLowerCase().indexOf(firstname.value.toLowerCase()) > -1) { //returns 0 or more if present
    alert('Password may not contain the firstname.');
    element.focus();
    return false;
}