Is it a good idea to ban users from choosing common passwords, it might be overkill for a small site, with a couple of thousand visitors a month… but if you sell a product or service where money exchanges hands, would you consider doing this?
Share
If it involves money or personal information you should force the user to have at least 6 characters of a mixture between numbers and letters (many say 8 but I like 6). You may want to store a table of common quick passwords that people should not use like 123456, etc.
You should also link an expiration date for each password (in my particular case users must change there password every 3 months). Keep track of previous passwords and warn users that they cannot use the same password (for at least a duration of time).