wppasskey

mbuiux

<p>Passwords are the single biggest security risk for your WordPress site. They get leaked, reused, or broken by automated brute-force attacks. Standard Two-Factor Authentication (2FA) adds safety, but typing in temporary codes from SMS or authenticator apps introduces annoying friction to your daily workflow.</p>
<p><strong>Advanced Passkeys for Secure Login</strong> brings the future of un-phishable, modern authentication directly to your WordPress site using the official FIDO2 / WebAuthn standard.</p>
<p>Users register a passkey just once using their device’s built-in biometric sensor (Face ID, Touch ID, Windows Hello) or a hardware security key (like a YubiKey). Future sign-ins take less than a second—completely bypassing the traditional password field.</p>
<h3>Why Switch to Passkeys?</h3>
<ul>
<li><strong>Immune to Phishing:</strong> Passkeys are cryptographically bound to your specific domain. A fake login page cannot trick or steal a passkey.</li>
<li><strong>Goodbye Brute-Force:</strong> Because there is no static password on the server to guess, automated bot attacks are completely neutralized.</li>
<li><strong>Ultimate Ecosystem Sync:</strong> Works seamlessly with iCloud Keychain, Google Password Manager, and 1Password for painless cross-device access.</li>
</ul>
<h3>Ecosystem-Wide Integrations Included</h3>
<p>Unlike basic alternatives, this plugin features intelligent, dependency-aware integration modules that automatically inject passkey entry points into your favorite plugins. It features out-of-the-box support for <strong>WooCommerce, Easy Digital Downloads, MemberPress, Ultimate Member, LearnDash, BuddyBoss, Gravity Forms, and PMPro</strong>.</p>
<h3>Features</h3>
<ul>
<li><strong>One-Click Passwordless Auth:</strong> Adds a native “Sign in with Passkey” button directly to the WordPress login screen.</li>
<li><strong>Ecosystem Integrations:</strong> Built-in aware modules, blocks, and shortcodes for WooCommerce, MemberPress, LearnDash, BuddyBoss, and more.</li>
<li><strong>Gutenberg Blocks & Shortcodes:</strong> Automatically registers custom login cards and shortcodes based on active plugins.</li>
<li><strong>Admin Dashboard Overview:</strong> Keep track of credential performance with an Authenticator Overview card and Last Login activity logs.</li>
<li><strong>Granular Role Controls:</strong> Easily configure exactly which user roles are permitted to use passkey authentication (Default: Administrators).</li>
<li><strong>Brute-Force Rate Limiting:</strong> Hardened local security with built-in login rate-limiting and automated daily log cleanups.</li>
<li><strong>Multisite Compatible:</strong> Network-aware provisioning instantly configures security settings for newly created network sites.</li>
<li><strong>Clean Performance & Housekeeping:</strong> Lightweight footprint with a clean uninstall routine that leaves zero orphaned tables or options behind.</li>
</ul>
<h3>Developer Hooks: Last Used Pill</h3>
<p>Developers can use these filters inside a theme or functionality plugin to globally customize or suppress the login form’s Last used passkey indicator pill.</p>
<h4>Available filters</h4>
<ul>
<li><code>advapafo_last_used_pill_freshness_days</code> — default 90 days</li>
<li><code>advapafo_last_used_pill_visible</code> — final on/off override</li>
<li><code>advapafo_last_used_pill_label</code> — customize label text</li>
</ul>
<h4>Example implementation</h4>
<pre><code><?php
/**
 * Example customization for Last used login pill.
 */

// Show pill if passkey login is within 120 days.
add_filter( 'advapafo_last_used_pill_freshness_days', function ( $days, $user ) {
    unset( $user );
    return 120;
}, 10, 2 );

// Hide pill for administrator accounts.
add_filter( 'advapafo_last_used_pill_visible', function ( $visible, $timestamp, $freshness_days, $user ) {
    unset( $timestamp, $freshness_days );

    if ( $user instanceof WP_User && in_array( 'administrator', (array) $user->roles, true ) ) {
        return false;
    }

    return $visible;
}, 10, 4 );

// Label override.
add_filter( 'advapafo_last_used_pill_label', function ( $label, $user ) {
    unset( $user );
    return 'Previously used';
}, 10, 2 );
</code></pre>


Advanced Passkeys for Secure Login

Secure WordPress with passwordless passkey login using Face ID, Touch ID, Windows Hello, and hardware security keys.

Mohamed Endisha

<p>Secure Passkeys is a powerful WordPress plugin that enables seamless passwordless authentication using WebAuthn technology. By eliminating the need for traditional passwords, it enhances security and improves the user login experience. With support for biometric authentication, security keys, and device-bound credentials, Secure Passkey provides a robust and user-friendly solution for modern authentication.</p>
<p>Unlike traditional password-based authentication, Secure Passkey leverages cryptographic key pairs to ensure secure logins. The private key remains securely stored on the user’s device, while the public key is registered with the WordPress site. This method protects against phishing attacks and password breaches, ensuring that only authorized users can gain access.</p>
<p>Secure Passkeys integrates effortlessly into WordPress, allowing users to register and manage their passkeys from their profile settings. Once registered, users can log in using their fingerprint, face recognition, or a hardware security key without the need to remember or enter a password.</p>
<h3>Features</h3>
<ul>
<li><strong>Passwordless Login:</strong> Secure authentication via WebAuthn with biometric devices, security keys, Touch ID, Face ID, and more.</li>
<li><strong>Enhanced User Experience:</strong>  Password-free login for a smoother user journey.</li>
<li><strong>Integration Support:</strong>
<ul>
<li>WordPress default login form</li>
<li>WooCommerce login page</li>
<li>MemberPress login form</li>
<li>Easy Digital Downloads login form</li>
<li>Ultimate Member login form</li>
</ul>
</li>
<li><strong>Admin Management:</strong>  Administrators can delete, activate, or deactivate users directly from plugin settings or user profiles.</li>
<li><strong>Passkeys Reminder Notice:</strong>  New option to enable or disable the passkeys reminder notice in the WordPress admin area for users who have not yet enabled passkeys.</li>
<li><strong>Activity Logging:</strong>  Monitor activity logs and track last login/registration of passkeys.</li>
<li><strong>Multiple Passkeys:</strong> Supports multiple passkey registrations per user, with the option to set a registration limit or allow unlimited registrations.</li>
<li><strong>Role Restrictions:</strong> Restrict and exclude specific user roles from using passkey authentication.</li>
<li><strong>Customizable Settings:</strong>  Adjust timeout settings for passkey registration and login.</li>
<li><strong>User Verification:</strong> Enforce user verification for enhanced security.</li>
<li><strong>Frontend Customization:</strong> Easily customize frontend themes or add your own with basic frontend skills.</li>
<li><strong>Theme Support:</strong> Supports pre-built themes like YOOtheme (UIkit) for frontend shortcodes.</li>
<li><strong>Shortcodes:</strong> Embed passkey login and registration forms on custom frontend pages.</li>
<li><strong>Passkey Display:</strong> Show passkey details in admin user lists and profiles.</li>
<li><strong>Multisite:</strong> Supports WordPress Multisite and single-site installations.</li>
<li><strong>Database Optimization:</strong>  Option to allow or disallow automatic deletion of old challenge records and activity logs (configurable schedule).</li>
</ul>
<h4>Requirements</h4>
<ul>
<li>WordPress 6.0 or newer.</li>
<li>PHP version 7.4 or newer.</li>
</ul>
<h3>License</h3>
<p>Secure Passkeys is licensed under the GNU General Public License v2 or later.</p>


Secure Passkeys


This is the best Passkey plugin for WP that I have ever used! Absolutely amazing work! Thank you !!


Awesome!!!!

Perfect - lightweight, simple and free

Secure Passkeys is a powerful WordPress plugin that enables passwordless authentication using WebAuthn technology.

Advanced Passkeys for Secure Login vs Secure Passkeys