wppasskey

mbuiux

<p>Passwords are the single biggest security risk for your WordPress site. They get leaked, reused, or broken by automated brute-force attacks. Standard Two-Factor Authentication (2FA) adds safety, but typing in temporary codes from SMS or authenticator apps introduces annoying friction to your daily workflow.</p>
<p><strong>Advanced Passkeys for Secure Login</strong> brings the future of un-phishable, modern authentication directly to your WordPress site using the official FIDO2 / WebAuthn standard.</p>
<p>Users register a passkey just once using their device’s built-in biometric sensor (Face ID, Touch ID, Windows Hello) or a hardware security key (like a YubiKey). Future sign-ins take less than a second—completely bypassing the traditional password field.</p>
<h3>Why Switch to Passkeys?</h3>
<ul>
<li><strong>Immune to Phishing:</strong> Passkeys are cryptographically bound to your specific domain. A fake login page cannot trick or steal a passkey.</li>
<li><strong>Goodbye Brute-Force:</strong> Because there is no static password on the server to guess, automated bot attacks are completely neutralized.</li>
<li><strong>Ultimate Ecosystem Sync:</strong> Works seamlessly with iCloud Keychain, Google Password Manager, and 1Password for painless cross-device access.</li>
</ul>
<h3>Ecosystem-Wide Integrations Included</h3>
<p>Unlike basic alternatives, this plugin features intelligent, dependency-aware integration modules that automatically inject passkey entry points into your favorite plugins. It features out-of-the-box support for <strong>WooCommerce, Easy Digital Downloads, MemberPress, Ultimate Member, LearnDash, BuddyBoss, Gravity Forms, and PMPro</strong>.</p>
<h3>Features</h3>
<ul>
<li><strong>One-Click Passwordless Auth:</strong> Adds a native “Sign in with Passkey” button directly to the WordPress login screen.</li>
<li><strong>Ecosystem Integrations:</strong> Built-in aware modules, blocks, and shortcodes for WooCommerce, MemberPress, LearnDash, BuddyBoss, and more.</li>
<li><strong>Gutenberg Blocks & Shortcodes:</strong> Automatically registers custom login cards and shortcodes based on active plugins.</li>
<li><strong>Admin Dashboard Overview:</strong> Keep track of credential performance with an Authenticator Overview card and Last Login activity logs.</li>
<li><strong>Granular Role Controls:</strong> Easily configure exactly which user roles are permitted to use passkey authentication (Default: Administrators).</li>
<li><strong>Brute-Force Rate Limiting:</strong> Hardened local security with built-in login rate-limiting and automated daily log cleanups.</li>
<li><strong>Multisite Compatible:</strong> Network-aware provisioning instantly configures security settings for newly created network sites.</li>
<li><strong>Clean Performance & Housekeeping:</strong> Lightweight footprint with a clean uninstall routine that leaves zero orphaned tables or options behind.</li>
</ul>
<h3>Developer Hooks: Last Used Pill</h3>
<p>Developers can use these filters inside a theme or functionality plugin to globally customize or suppress the login form’s Last used passkey indicator pill.</p>
<h4>Available filters</h4>
<ul>
<li><code>advapafo_last_used_pill_freshness_days</code> — default 90 days</li>
<li><code>advapafo_last_used_pill_visible</code> — final on/off override</li>
<li><code>advapafo_last_used_pill_label</code> — customize label text</li>
</ul>
<h4>Example implementation</h4>
<pre><code><?php
/**
 * Example customization for Last used login pill.
 */

// Show pill if passkey login is within 120 days.
add_filter( 'advapafo_last_used_pill_freshness_days', function ( $days, $user ) {
    unset( $user );
    return 120;
}, 10, 2 );

// Hide pill for administrator accounts.
add_filter( 'advapafo_last_used_pill_visible', function ( $visible, $timestamp, $freshness_days, $user ) {
    unset( $timestamp, $freshness_days );

    if ( $user instanceof WP_User && in_array( 'administrator', (array) $user->roles, true ) ) {
        return false;
    }

    return $visible;
}, 10, 4 );

// Label override.
add_filter( 'advapafo_last_used_pill_label', function ( $label, $user ) {
    unset( $user );
    return 'Previously used';
}, 10, 2 );
</code></pre>


Advanced Passkeys for Secure Login

Secure WordPress with passwordless passkey login using Face ID, Touch ID, Windows Hello, and hardware security keys.

Clayton LZ

<p><strong>Bye Bye Passwords</strong> brings modern passwordless authentication to WordPress using WebAuthn/Passkeys technology. Say goodbye to weak passwords and hello to secure, convenient login with biometrics, security keys, or platform authenticators.</p>
<h4>Key Features</h4>
<ul>
<li><strong>Passwordless Login</strong> – Sign in using Touch ID, Face ID, Windows Hello, or security keys</li>
<li><strong>Multiple Passkeys</strong> – Register multiple devices for convenient access anywhere</li>
<li><strong>Recovery Codes</strong> – Generate one-time backup codes for emergency access</li>
<li><strong>Enhanced Security</strong> – Eliminate password-based attacks completely</li>
<li><strong>User-Friendly</strong> – Simple setup with no technical knowledge required</li>
<li><strong>Privacy-Focused</strong> – Your authentication data stays on your server</li>
<li><strong>WordPress Integration</strong> – Seamlessly integrated into WordPress admin and login</li>
</ul>
<h4>How It Works</h4>
<ol>
<li>Register a passkey from your WordPress admin profile</li>
<li>Use your device’s built-in authentication (fingerprint, face, PIN)</li>
<li>Sign in instantly without typing passwords</li>
</ol>
<h4>Requirements</h4>
<ul>
<li>SSL/HTTPS enabled website (required for WebAuthn)</li>
<li>Modern browser with WebAuthn support</li>
<li>PHP 7.2 or higher</li>
<li>WordPress 5.0 or higher</li>
</ul>
<h3>External Services</h3>
<p>This plugin may connect to the FIDO Alliance Metadata Service (MDS) to download root certificates for authenticator validation.</p>
<h4>FIDO Alliance Metadata Service</h4>
<ul>
<li><strong>URL:</strong> https://mds.fidoalliance.org/</li>
<li><strong>Purpose:</strong> Downloads attestation root certificates to verify the authenticity of security keys and passkey devices</li>
<li><strong>When:</strong> Only when attestation verification is enabled and the plugin needs to update its certificate store (not during normal authentication)</li>
<li><strong>Data sent:</strong> No personal or user data is transmitted – only a standard HTTP GET request</li>
<li><strong>Service provider:</strong> FIDO Alliance</li>
<li><strong>Terms of Use:</strong> https://fidoalliance.org/metadata/</li>
<li><strong>Privacy Policy:</strong> https://fidoalliance.org/privacy-policy/</li>
</ul>
<p>No user data, credentials, or personal information is ever sent to external services. All authentication happens locally on your server.</p>


Bye Bye Passwords

Enable passwordless authentication for WordPress using WebAuthn/Passkeys. More secure, more convenient.

Advanced Passkeys for Secure Login vs Bye Bye Passwords