Volodymyr Kolesnykov

<p>This plugin adds WebAuthn and passkey support to the <a href="https://wordpress.org/plugins/two-factor/" rel="ugc">Two Factor</a> plugin, providing a modern, secure authentication method.</p>
<p><strong>Features:</strong></p>
<ul>
<li>Support for WebAuthn and passkeys (Windows Hello, Touch ID, YubiKeys, etc.)</li>
<li>Backward compatibility with previously registered U2F security keys</li>
<li>User-friendly settings and seamless authentication experience</li>
<li>Customizable error logging and behavior via action hooks</li>
<li>Works with the Two Factor plugin for flexible 2FA authentication</li>
</ul>
<p>The plugin enables users to register and use hardware security keys and platform authenticators for stronger protection against password-based attacks and phishing.</p>
<p>Notes:</p>
<ul>
<li>please use <a href="https://github.com/sjinks/wp-two-factor-provider-webauthn/issues" rel="nofollow ugc">GitHub issues</a> to report bugs;</li>
<li>the full source code with all development files is available on <a href="https://github.com/sjinks/wp-two-factor-provider-webauthn" rel="nofollow ugc">GitHub</a>.</li>
</ul>


WebAuthn Provider for Two Factor

Thank you so much for this plugin!!  

In February 2022 Chrome changed things so hardware security keys would no longer work with the "Two Factor" plugin. Installing this add-on gets it working again. 

I had to change the "User Verification Requirement" to "Discouraged" in order to use my existing Yubikey (without re-adding it). Otherwise, it asked for a PIN but then wouldn't recognize my key.

Hopefully it can get merged directly into the Two Factor plugin soon? 😁🙏

Two Factor works with hardware keys again!

Thank you for bridging the gap while we wait for the PR. 
This is what Open Source is all about. 

FIDO U2F WebAuthn for Two Factor


This is helpful for evaluating purposes of the code. As this plugin is part of a security level all the code should be readable easily for auditors.



Besides that, well done.Thank you.


Works well for my use case but please provide unminified JS files.


This is great. You can literally log into WordPress with 2FA using one touch (password manager with auto-login combined with this for 2FA). Beats using an authenticator app any day.


One touch 2FA is a dream

WebAuthn authentication provider for Two Factor plugin.

wppasskey

mbuiux

<p>Passwords are the single biggest security risk for your WordPress site. They get leaked, reused, or broken by automated brute-force attacks. Standard Two-Factor Authentication (2FA) adds safety, but typing in temporary codes from SMS or authenticator apps introduces annoying friction to your daily workflow.</p>
<p><strong>Advanced Passkeys for Secure Login</strong> brings the future of un-phishable, modern authentication directly to your WordPress site using the official FIDO2 / WebAuthn standard.</p>
<p>Users register a passkey just once using their device’s built-in biometric sensor (Face ID, Touch ID, Windows Hello) or a hardware security key (like a YubiKey). Future sign-ins take less than a second—completely bypassing the traditional password field.</p>
<h3>Why Switch to Passkeys?</h3>
<ul>
<li><strong>Immune to Phishing:</strong> Passkeys are cryptographically bound to your specific domain. A fake login page cannot trick or steal a passkey.</li>
<li><strong>Goodbye Brute-Force:</strong> Because there is no static password on the server to guess, automated bot attacks are completely neutralized.</li>
<li><strong>Ultimate Ecosystem Sync:</strong> Works seamlessly with iCloud Keychain, Google Password Manager, and 1Password for painless cross-device access.</li>
</ul>
<h3>Ecosystem-Wide Integrations Included</h3>
<p>Unlike basic alternatives, this plugin features intelligent, dependency-aware integration modules that automatically inject passkey entry points into your favorite plugins. It features out-of-the-box support for <strong>WooCommerce, Easy Digital Downloads, MemberPress, Ultimate Member, LearnDash, BuddyBoss, Gravity Forms, and PMPro</strong>.</p>
<h3>Features</h3>
<ul>
<li><strong>One-Click Passwordless Auth:</strong> Adds a native “Sign in with Passkey” button directly to the WordPress login screen.</li>
<li><strong>Ecosystem Integrations:</strong> Built-in aware modules, blocks, and shortcodes for WooCommerce, MemberPress, LearnDash, BuddyBoss, and more.</li>
<li><strong>Gutenberg Blocks & Shortcodes:</strong> Automatically registers custom login cards and shortcodes based on active plugins.</li>
<li><strong>Admin Dashboard Overview:</strong> Keep track of credential performance with an Authenticator Overview card and Last Login activity logs.</li>
<li><strong>Granular Role Controls:</strong> Easily configure exactly which user roles are permitted to use passkey authentication (Default: Administrators).</li>
<li><strong>Brute-Force Rate Limiting:</strong> Hardened local security with built-in login rate-limiting and automated daily log cleanups.</li>
<li><strong>Multisite Compatible:</strong> Network-aware provisioning instantly configures security settings for newly created network sites.</li>
<li><strong>Clean Performance & Housekeeping:</strong> Lightweight footprint with a clean uninstall routine that leaves zero orphaned tables or options behind.</li>
</ul>
<h3>Developer Hooks: Last Used Pill</h3>
<p>Developers can use these filters inside a theme or functionality plugin to globally customize or suppress the login form’s Last used passkey indicator pill.</p>
<h4>Available filters</h4>
<ul>
<li><code>advapafo_last_used_pill_freshness_days</code> — default 90 days</li>
<li><code>advapafo_last_used_pill_visible</code> — final on/off override</li>
<li><code>advapafo_last_used_pill_label</code> — customize label text</li>
</ul>
<h4>Example implementation</h4>
<pre><code><?php
/**
 * Example customization for Last used login pill.
 */

// Show pill if passkey login is within 120 days.
add_filter( 'advapafo_last_used_pill_freshness_days', function ( $days, $user ) {
    unset( $user );
    return 120;
}, 10, 2 );

// Hide pill for administrator accounts.
add_filter( 'advapafo_last_used_pill_visible', function ( $visible, $timestamp, $freshness_days, $user ) {
    unset( $timestamp, $freshness_days );

    if ( $user instanceof WP_User && in_array( 'administrator', (array) $user->roles, true ) ) {
        return false;
    }

    return $visible;
}, 10, 4 );

// Label override.
add_filter( 'advapafo_last_used_pill_label', function ( $label, $user ) {
    unset( $user );
    return 'Previously used';
}, 10, 2 );
</code></pre>


Advanced Passkeys for Secure Login

Secure WordPress with passwordless passkey login using Face ID, Touch ID, Windows Hello, and hardware security keys.

WebAuthn Provider for Two Factor vs Advanced Passkeys for Secure Login