wppasskey

mbuiux

Passwords are the single biggest security risk for your WordPress site. They get leaked, reused, or broken by automated brute-force attacks. Standard Two-Factor Authentication (2FA) adds safety, but typing in temporary codes from SMS or authenticator apps introduces annoying friction to your daily workflow.
Advanced Passkeys for Secure Login brings the future of un-phishable, modern authentication directly to your WordPress site using the official FIDO2 / WebAuthn standard.
Users register a passkey just once using their device’s built-in biometric sensor (Face ID, Touch ID, Windows Hello) or a hardware security key (like a YubiKey). Future sign-ins take less than a second—completely bypassing the traditional password field.
<h3>Why Switch to Passkeys?</h3>
<ul>
<li>Immune to Phishing: Passkeys are cryptographically bound to your specific domain. A fake login page cannot trick or steal a passkey.</li>
<li>Goodbye Brute-Force: Because there is no static password on the server to guess, automated bot attacks are completely neutralized.</li>
<li>Ultimate Ecosystem Sync: Works seamlessly with iCloud Keychain, Google Password Manager, and 1Password for painless cross-device access.</li>
</ul>
<h3>Ecosystem-Wide Integrations Included</h3>
Unlike basic alternatives, this plugin features intelligent, dependency-aware integration modules that automatically inject passkey entry points into your favorite plugins. It features out-of-the-box support for WooCommerce, Easy Digital Downloads, MemberPress, Ultimate Member, LearnDash, BuddyBoss, Gravity Forms, and PMPro.
<h3>Features</h3>
<ul>
<li>One-Click Passwordless Auth: Adds a native “Sign in with Passkey” button directly to the WordPress login screen.</li>
<li>Ecosystem Integrations: Built-in aware modules, blocks, and shortcodes for WooCommerce, MemberPress, LearnDash, BuddyBoss, and more.</li>
<li>Gutenberg Blocks & Shortcodes: Automatically registers custom login cards and shortcodes based on active plugins.</li>
<li>Admin Dashboard Overview: Keep track of credential performance with an Authenticator Overview card and Last Login activity logs.</li>
<li>Granular Role Controls: Easily configure exactly which user roles are permitted to use passkey authentication (Default: Administrators).</li>
<li>Brute-Force Rate Limiting: Hardened local security with built-in login rate-limiting and automated daily log cleanups.</li>
<li>Multisite Compatible: Network-aware provisioning instantly configures security settings for newly created network sites.</li>
<li>Clean Performance & Housekeeping: Lightweight footprint with a clean uninstall routine that leaves zero orphaned tables or options behind.</li>
</ul>
<h3>Developer Hooks: Last Used Pill</h3>
Developers can use these filters inside a theme or functionality plugin to globally customize or suppress the login form’s Last used passkey indicator pill.
<h4>Available filters</h4>
<ul>
<li><code>advapafo_last_used_pill_freshness_days</code> — default 90 days</li>
<li><code>advapafo_last_used_pill_visible</code> — final on/off override</li>
<li><code>advapafo_last_used_pill_label</code> — customize label text</li>
</ul>
<h4>Example implementation</h4>
<pre><code><?php
/**
 * Example customization for Last used login pill.
 */

// Show pill if passkey login is within 120 days.
add_filter( 'advapafo_last_used_pill_freshness_days', function ( $days, $user ) {
 unset( $user );
 return 120;
}, 10, 2 );

// Hide pill for administrator accounts.
add_filter( 'advapafo_last_used_pill_visible', function ( $visible, $timestamp, $freshness_days, $user ) {
 unset( $timestamp, $freshness_days );

 if ( $user instanceof WP_User && in_array( 'administrator', (array) $user->roles, true ) ) {
 return false;
 }

 return $visible;
}, 10, 4 );

// Label override.
add_filter( 'advapafo_last_used_pill_label', function ( $label, $user ) {
 unset( $user );
 return 'Previously used';
}, 10, 2 );
</code></pre>

Advanced Passkeys for Secure Login

Secure WordPress with passwordless passkey login using Face ID, Touch ID, Windows Hello, and hardware security keys.

Anna Garcia

Are you or your customers tired of remembering passwords?
This plugin provides a secure and convenient solution to log into your WordPress website. With Beyond Identity, you can say goodbye to password fatigue and improve your website’s security.
Once activated, you will see:
<ul>
<li>
Passwordless UI that integrates seamlessly on with the WordPress login page.
</li>
<li>
Beyond Identity Settings page for WordPress admins to configure their Beyond Identity account.
</li>
<li>
Beyond Identity filter on the WordPress Dashboard’s Users page to view which users use passkeys.
</li>
</ul>
Before you begin
You will need a Beyond Identity account to configure this plugin. 
Beyond Identity currently uses “Universal Passkeys,” which are specific to Beyond Identity and have two benefits over your average FIDO2 passkeys. 
1. Universal Passkeys never leave the device on which they are created. This makes them much more secure. 
2. Universal Passkeys work everywhere. Some browsers (Firefox) do not support passkeys. Universal Passkeys work everywhere, even on Firefox.
Coming soon: Vanilla WebAuthn FIDO2 passkeys. These passkeys allow syncing between devices and work with passkey managers.
As a Beyond Identity admin, you will have several configuration options including selecting passkey flavors and customizing the login page.
<h3>Admin Set Up</h3>
First, sign up for a free developer account by visiting: https://www.beyondidentity.com/developers
Once you have a developer account you will need to set several values for the OIDC server. Follow the steps below to configure a Beyond Identity application. Most defaults are fine. However make sure the following are set:
<ol>
<li>In your Beyond Identity Console, navigate to the Apps tab under Authentication</li>
<li>Tap Add an application</li>
<li>Set Protocol to OIDC</li>
<li>Set Client Type to Confidential</li>
<li>Set PKCE to Disabled</li>
<li>Set Redirect URIs to include <code>https://${your-website-domain.com}/wp-admin/admin-ajax.php?action=openid-connect-authorize</code></li>
<li>Set Token Configuration > Subject to id</li>
<li>At the top of the page, navigate to your application’s Authenticator Config tab</li>
<li>Set Configuration Type to Hosted Web</li>
<li>The recommended defaults for Authentication Profile are fine but feel free to modify</li>
<li>Tap the Submit button to save your changes</li>
</ol>
Finally, go to your WordPress dashboard and find the Beyond Identity Settings page. You will need three generated values from your newly created application. You can find the Issuer URL, Client ID, and Client Secret in the Beyond Identity Console’s application that you just created.
For more information on how Beyond Identity works, visit the <a href="http://developer.beyondidentity.com" rel="nofollow ugc">developer documentation</a>.
For help, reach out on <a href="https://join.slack.com/t/byndid/shared_invite/zt-1anns8n83-NQX4JvW7coi9dksADxgeBQ" rel="nofollow ugc">Slack</a>.
<h3>Shortcodes</h3>
This plugin also provides shortcodes that can be used on any page or post. These include:
<pre><code>[beyond_identity_login_button] 
</code></pre>
Generates a button to log in with a Beyond Identity Universal Passkey.
<pre><code>[beyond_identity_auth_url] 
</code></pre>
Generates the authorize URL to log in with a Beyond Identity Universal Passkey.
For information on shortcode customization attributes, please refer to the documentation available in the Settings > Beyond Identity dashboard page after activating the plugin.

Beyond Identity Passwordless

A passwordless solution that allows users and admins to log into a WordPress website using passkeys with Beyond Identity.

Advanced Passkeys for Secure Login vs Beyond Identity Passwordless