On most web hosting platforms and every other environment requiring user login, it is recommended that users change their passwords after a certain time period. This provides an additional security layer to protect their network and servers. They also want users on their WordPress sites to change passwords after every few months. In this article, we will show you how to force users to change passwords in WordPress by expiring their passwords after a given time period

To expire user passwords after a period, first, thing to do is install and activate the WP Password Policy Manager plugin. Upon activation, you need to visit Settings » Password Policies page to configure the plugin settings

The first option on the settings page allows you to set number of days after which a user must change their password. After that there are options which allow you to enforce strong passwords.

You can set the minimum characters required in a password. You can also force users to use numbers and special characters in their passwords.

You can set the plugin to remember previous user passwords. This is useful incase a user forgets that they have changed their password. The plugin can then show them a notice that they are entering an older password which is no longer valid.

Lastly, ‘Reset All User’s Passwords’ button allows you to quickly reset passwords. This will immediately expire all user passwords in WordPress.
Don’t forget to click on the save changes button to store your settings.

Credit: https://www.todhost.com/knowledgebase/708/How-to-force-WordPress-users-to-change-their-passwords.html