Kakshak Kalaria

Adarsh Verma

Concatstring Solutions

Sumit Tejani

Hardik Patel

Vrutika Darji

<p><strong>CS BioLogin</strong> adds passwordless sign-in to WordPress using the WebAuthn standard (FIDO2 / passkeys). Visitors can authenticate with Face ID, Touch ID, Windows Hello, or a platform fingerprint reader. Biometric templates never leave the user’s device; only public key credentials are stored in your WordPress database.</p>
<h4>What this plugin does</h4>
<ul>
<li>Adds a <strong>Sign in with Biometrics</strong> option on the WordPress login screen (with optional password fallback).</li>
<li>Lets logged-in users <strong>register, rename, update, and remove</strong> passkeys from their profile, a front-end shortcode page, or WooCommerce My Account.</li>
<li>Provides an admin screen for <strong>settings, security logs, and per-user device management</strong>.</li>
<li>Applies <strong>rate limiting and lockout</strong> on authentication attempts.</li>
</ul>
<h4>What this plugin does NOT do</h4>
<ul>
<li>It does <strong>not</strong> send user data, credentials, or biometrics to third-party servers. All verification runs on your site over HTTPS.</li>
<li>It does <strong>not</strong> store fingerprint or face images—only WebAuthn public keys and device metadata you configure.</li>
</ul>
<h4>How it works</h4>
<ol>
<li><strong>Administrator</strong> enables the plugin under <strong>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> CS BioLogin</strong> and chooses which roles may use biometrics.</li>
<li><strong>User</strong> opens their profile (WordPress admin profile, <code>[csbisebi_device_manager]</code> page, or WooCommerce <strong>My Account <span aria-hidden="true" class="wp-exclude-emoji">→</span> CS BioLogin</strong>) and clicks <strong>Add Biometric Device</strong>. The browser shows the OS passkey/biometric prompt.</li>
<li><strong>Login</strong> — On <code>wp-login.php</code> (or WooCommerce login), the user chooses biometric sign-in. The plugin issues a WebAuthn challenge via the REST API, verifies the signed response, and creates a normal WordPress session.</li>
</ol>
<p>REST routes live under <code>csbisebi-biometric-login/v1</code> on your own site (for example <code>/wp-json/csbisebi-biometric-login/v1/auth/options</code>). No external API keys are required.</p>
<h4>WooCommerce</h4>
<p>When WooCommerce is active, CS BioLogin adds a <strong>My Account</strong> tab, checkout/account login prompts, and automatic use of the account area instead of a standalone management page.</p>
<h4>Requirements</h4>
<ul>
<li>WordPress 6.2 or later</li>
<li>PHP 7.4+ with OpenSSL</li>
<li><strong>HTTPS</strong> on production (WebAuthn requires a secure context; <code>localhost</code> and <code>*.local</code> are allowed for development)</li>
</ul>
<h4>Privacy and data storage</h4>
<ul>
<li>Biometric samples stay on the user’s device.</li>
<li>The plugin stores passkey public keys, optional device labels, timestamps, and security log entries in your WordPress database.</li>
<li>Uninstalling the plugin (when data removal is enabled via uninstall) drops the custom credentials table and plugin options.</li>
</ul>


CS BioLogin – Seamless Biometric Authentication

Secure biometric login (WebAuthn / FIDO2 / Passkeys) for WordPress and WooCommerce using Face ID, Touch ID, or fingerprint.

miniOrange

miniorange

<p>Meet the new global standard of web authentication (WebAuthn). WebAuthn is a core component of FIDO2 Alliance which includes protocols that are based on public key cryptography and are strongly resistant to phishing (to varying degrees).<br />
WebAuthn is a browser-based API by FIDO2 that allows web applications to simplify and secure user authentication by using their registered devices (android phones/ iphones, laptops, etc.) as factors. WebAuthn uses public key cryptography by FIDO2 to protect users from advanced phishing attacks. With WebAuthn’s Passwordless login using Fingerprint, FaceID, Touch ID plugin, you can allow your users to login to your website by just entering their device credentials (Fingerprint, windows hello, face ID, touch ID, etc).</p>
<p>WebAuthn increases the security of your website by providing an additional layer of security and it also enhances the user experience of your website. Webauthn protects your website from many common attacks like phishing, brute force protection, man in the middle attack, malwares, etc.</p>
<p><strong><a href="https://www.miniorange.com/webauthn" rel="nofollow ugc">WebAuthn</a> requires HTTPS connection or <code>localhost</code> for secure authentication</strong></p>
<h4>Passwordless login with webauthn</h4>
<p>FIDO2/WebAuthn implements the concept of passwordless authentication. The users will enter their username and if their device/keys are configured with WebAuthn then they need to verify it for successful login. If the device is not registered for WebAuthn, then users need to enter their password and then they can configure the WebAuthn. This will make the user experience better by removing the password. It will also increase the security as webauthn is based on public key cryptography authentication and it allows the user to login only if the user is authenticated from the trusted device.</p>
<h4>WebAuthn as the [second factor](https://plugins.miniorange.com/2-factor-authentication-for-wordpress)</h4>
<p>WebAuthn is also used as the <a href="https://plugins.miniorange.com/login-to-your-wordpress-site-with-fingerprint-and-faceid-using-webauthn" rel="nofollow ugc">second factor</a> to add an extra layer of security on your website. In this case the users will enter their username and password to verify their first factor and after that they will be prompted with the WebAuthn for verification of the second layer of security. This will protect your website even if the users’ passwords are compromised, because to verify the identity of any user you need to confirm the web authentication with their device.</p>
<h4>Usernameless login with WebAuthn*</h4>
<p>WebAuthn also allows you to provide an option where users can login to your website without entering their username and password. The user will be automatically picked at login via WebAuthn.</p>
<p>As most of the users do not want to maintain too many credentials so in that case you can allow your users to use their device as the credentials and if the device is verified they will be logged into the site.</p>
<h4>Device limitation*</h4>
<p>The WebAuthn plugin provides an option where you can put a limit on the number of devices a user can register with WebAuthn. This will be helpful when you want only a particular device to login to the website.<br />
This will allow you to restrict the number of devices a user can use to access your website.</p>
<h4>Role based WebAuthn*</h4>
<p>With this you can allow WebAuthn to specific user roles. The users who have been allowed to use WebAuthn can login with WebAuthn and others will use their usual wordpress login credentials for access, without getting prompted for the WebAuthn.</p>
<h4>User-specific WebAuthn</h4>
<p>With this you can select the specific users who can login using WebAuthn to your website. Other users have to use their WordPress credentials to login.</p>
<ul>
<li>supported in the Premium version</li>
</ul>


WebAuthn – Passwordless login using Fingerprint, FaceID, Touch ID, Yubikey

WebAuthn is a new way of authenticating your user on the website. WebAuthn by the…

CS BioLogin – Seamless Biometric Authentication vs WebAuthn – Passwordless login using Fingerprint, FaceID, Touch ID, Yubikey