Check if your users passwords have been leaked before and check if they are strong enough