Attempting to Limit User Password Length Through PHP Plugins

[kh99]

I think your problem is that normally the user's browser hashes the password and clears the plain text password field. You can disable that by defining DISABLE_PASSWORD_CLEARING to 1, such as in your config.php or in a plugin:

define('DISABLE_PASSWORD_CLEARING', 1);

or if you wanted you might be able to define it only for the registration and profile pages so that you still have that security feature for normal logins.