Volodymyr Kolesnykov

<p>This plugin adds WebAuthn and passkey support to the <a href="https://wordpress.org/plugins/two-factor/" rel="ugc">Two Factor</a> plugin, providing a modern, secure authentication method.</p>
<p><strong>Features:</strong></p>
<ul>
<li>Support for WebAuthn and passkeys (Windows Hello, Touch ID, YubiKeys, etc.)</li>
<li>Backward compatibility with previously registered U2F security keys</li>
<li>User-friendly settings and seamless authentication experience</li>
<li>Customizable error logging and behavior via action hooks</li>
<li>Works with the Two Factor plugin for flexible 2FA authentication</li>
</ul>
<p>The plugin enables users to register and use hardware security keys and platform authenticators for stronger protection against password-based attacks and phishing.</p>
<p>Notes:</p>
<ul>
<li>please use <a href="https://github.com/sjinks/wp-two-factor-provider-webauthn/issues" rel="nofollow ugc">GitHub issues</a> to report bugs;</li>
<li>the full source code with all development files is available on <a href="https://github.com/sjinks/wp-two-factor-provider-webauthn" rel="nofollow ugc">GitHub</a>.</li>
</ul>


WebAuthn Provider for Two Factor

Thank you so much for this plugin!!  

In February 2022 Chrome changed things so hardware security keys would no longer work with the "Two Factor" plugin. Installing this add-on gets it working again. 

I had to change the "User Verification Requirement" to "Discouraged" in order to use my existing Yubikey (without re-adding it). Otherwise, it asked for a PIN but then wouldn't recognize my key.

Hopefully it can get merged directly into the Two Factor plugin soon? 😁🙏

Two Factor works with hardware keys again!

Thank you for bridging the gap while we wait for the PR. 
This is what Open Source is all about. 

FIDO U2F WebAuthn for Two Factor


This is helpful for evaluating purposes of the code. As this plugin is part of a security level all the code should be readable easily for auditors.



Besides that, well done.Thank you.


Works well for my use case but please provide unminified JS files.


This is great. You can literally log into WordPress with 2FA using one touch (password manager with auto-login combined with this for 2FA). Beats using an authenticator app any day.


One touch 2FA is a dream

WebAuthn authentication provider for Two Factor plugin.

Kakshak Kalaria

Adarsh Verma

Concatstring Solutions

Sumit Tejani

Hardik Patel

Vrutika Darji

<p><strong>CS BioLogin</strong> adds passwordless sign-in to WordPress using the WebAuthn standard (FIDO2 / passkeys). Visitors can authenticate with Face ID, Touch ID, Windows Hello, or a platform fingerprint reader. Biometric templates never leave the user’s device; only public key credentials are stored in your WordPress database.</p>
<h4>What this plugin does</h4>
<ul>
<li>Adds a <strong>Sign in with Biometrics</strong> option on the WordPress login screen (with optional password fallback).</li>
<li>Lets logged-in users <strong>register, rename, update, and remove</strong> passkeys from their profile, a front-end shortcode page, or WooCommerce My Account.</li>
<li>Provides an admin screen for <strong>settings, security logs, and per-user device management</strong>.</li>
<li>Applies <strong>rate limiting and lockout</strong> on authentication attempts.</li>
</ul>
<h4>What this plugin does NOT do</h4>
<ul>
<li>It does <strong>not</strong> send user data, credentials, or biometrics to third-party servers. All verification runs on your site over HTTPS.</li>
<li>It does <strong>not</strong> store fingerprint or face images—only WebAuthn public keys and device metadata you configure.</li>
</ul>
<h4>How it works</h4>
<ol>
<li><strong>Administrator</strong> enables the plugin under <strong>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> CS BioLogin</strong> and chooses which roles may use biometrics.</li>
<li><strong>User</strong> opens their profile (WordPress admin profile, <code>[csbisebi_device_manager]</code> page, or WooCommerce <strong>My Account <span aria-hidden="true" class="wp-exclude-emoji">→</span> CS BioLogin</strong>) and clicks <strong>Add Biometric Device</strong>. The browser shows the OS passkey/biometric prompt.</li>
<li><strong>Login</strong> — On <code>wp-login.php</code> (or WooCommerce login), the user chooses biometric sign-in. The plugin issues a WebAuthn challenge via the REST API, verifies the signed response, and creates a normal WordPress session.</li>
</ol>
<p>REST routes live under <code>csbisebi-biometric-login/v1</code> on your own site (for example <code>/wp-json/csbisebi-biometric-login/v1/auth/options</code>). No external API keys are required.</p>
<h4>WooCommerce</h4>
<p>When WooCommerce is active, CS BioLogin adds a <strong>My Account</strong> tab, checkout/account login prompts, and automatic use of the account area instead of a standalone management page.</p>
<h4>Requirements</h4>
<ul>
<li>WordPress 6.2 or later</li>
<li>PHP 7.4+ with OpenSSL</li>
<li><strong>HTTPS</strong> on production (WebAuthn requires a secure context; <code>localhost</code> and <code>*.local</code> are allowed for development)</li>
</ul>
<h4>Privacy and data storage</h4>
<ul>
<li>Biometric samples stay on the user’s device.</li>
<li>The plugin stores passkey public keys, optional device labels, timestamps, and security log entries in your WordPress database.</li>
<li>Uninstalling the plugin (when data removal is enabled via uninstall) drops the custom credentials table and plugin options.</li>
</ul>


CS BioLogin – Seamless Biometric Authentication

Secure biometric login (WebAuthn / FIDO2 / Passkeys) for WordPress and WooCommerce using Face ID, Touch ID, or fingerprint.

WebAuthn Provider for Two Factor vs CS BioLogin – Seamless Biometric Authentication