Passkeys let a user sign in without entering their WordPress password. A passkey uses a device unlock method such as fingerprint, face recognition, a device password, a PIN, or a password manager. The site does not receive the user’s fingerprint, face scan, PIN, or device password.

Administrators control which roles can use or require passkeys from the Login Security Options page. Passkeys are enabled by default for administrators and can be enabled for other roles. On multisite installations, passkeys are currently limited to Super Administrators.

How passkeys work with Wordfence

When a user registers a passkey, the browser, device, or password manager creates a passkey for this site. The passkey is tied to the site’s passkey credential domain, and the private part of the passkey stays with the user’s device or password manager. Wordfence stores information such as the passkey label, credential ID, public key, sign-in counter, creation time, and last-used time.

A passkey can be used as an alternative to a username and password. If the user’s role is set to Optional, username/password login remains available unless the user disables it for their own account. If the user’s role is set to Required, username/password login is blocked after any grace period expires.

Passkey login can be used on the standard WordPress login page when passkeys exist on the site. If WooCommerce integration is enabled, passkey login can also be used on supported WooCommerce login forms.

Browser, device, and password manager support

Passkeys require browser support for WebAuthn/passkeys. Most current browsers support passkeys, but available options depend on the browser, operating system, device, and password manager. Some users may be prompted to use a fingerprint, face recognition, device PIN, device password, security key, phone, or password manager.

If the browser does not support passkey registration or login, Wordfence will show a message that passkeys are not available in that browser. The user can try a different browser, device, or password manager that supports passkeys.

Adding a passkey

A user can add a passkey from their Login Security page when their role is allowed to use passkeys. Administrators can view and remove passkeys for other users, but they cannot register a new passkey for another user’s account because passkey registration must be completed by the account owner in that user’s browser, device, or password manager.

To add a passkey:

1. Open Login Security and choose the Passkeys section.
2. Enter a recognizable passkey name. A password manager name, device name, or account provider name can make it easier to identify later.
3. Start registration and approve the browser, device, security key, or password manager prompt.
4. Confirm that the new passkey appears in the registered passkeys list.

Registered passkeys show their label, creation time, and last-used time. Removing a passkey in Wordfence removes it from the site, but may not remove it from the user’s device or password manager.

Logging in with a passkey

When passkeys are available on the site, the login page includes a “Log In with a Passkey” button. Click the button and approve the browser, device, security key, or password manager prompt. If the selected passkey is registered for the site and account, Wordfence logs the user in through WordPress.

A valid passkey login does not require a separate 2FA code. If reCAPTCHA is enabled, a valid passkey login also skips the CAPTCHA challenge. Username/password logins are still subject to any configured 2FA and reCAPTCHA requirements.

If the selected passkey is not registered for the site, or belongs to a different account than expected, Wordfence will reject the login. Try again and choose the correct passkey, or use another available login method if one is allowed for the account.

Allowing or disabling username/password login

Users with at least one passkey may see an “Allow username/password authentication” option. When this option is disabled, username/password login is blocked for that account while a passkey is registered. The user must log in with a passkey.

Before disabling username/password login, register more than one passkey or use a password manager that can sync passkeys to multiple devices. Test passkey login in another browser, another device, or a private browsing window before logging out.

If passkeys are required for one of the user’s roles, the per-user username/password option cannot override that requirement. Username/password login remains blocked after the grace period expires.

Backup passkeys and account safety

We recommend registering more than one passkey, or using a password manager or account provider that syncs passkeys to more than one device. A passkey stored only on one phone, computer, or security key can become unavailable if that device is lost, broken, reset, or replaced.

If passkeys are required or username/password login has been disabled for the account, a prompt or message asking the user to use their WordPress password may be suspicious. Users should make sure they are on the correct site before approving any passkey prompt or entering credentials.

Required passkeys and grace periods

Administrators can set passkeys to Required for selected roles from Login Security Options. Users in those roles must register a passkey before the grace period ends. The same grace period setting is used for required 2FA and required passkeys.

Users in a grace period can log in and will be reminded to set up the required authentication method. If the grace period expires and the user has no passkey, username/password login is blocked. An administrator can reset the user’s grace period or change the role requirement if access needs to be restored.

When requiring passkeys for administrators or other high-access roles, each affected user should have at least one backup passkey and should test passkey login before logging out. Losing access to the only passkey can prevent the user from logging in.

WooCommerce and custom account pages

If WooCommerce integration is enabled, Wordfence can add passkey login support to supported WooCommerce login forms. The Wordfence Login Security tab on the WooCommerce account page can also let customers manage passkey and 2FA credentials outside wp-admin.

For custom account pages, administrators can enable the Passkey/2FA management shortcode setting and use [wordfence_passkey_management] to provide passkey management. The 2FA shortcode is [wordfence_2fa_management]. Both shortcodes support a stacked attribute, such as [wordfence_passkey_management stacked="true"].

If customers need passkeys, the Optional role setting is recommended. Requiring passkeys for WooCommerce customers is not recommended because some customers may have difficulty setting up or using passkey authentication.

XML-RPC, application passwords, and API access

When passkeys are required for a user, ordinary username/password XML-RPC authentication is blocked for that user. If API access is needed, use WordPress application passwords where possible. Application passwords can be accepted by WordPress for API access even when passkeys are required for the account.

Troubleshooting passkeys

• If the browser says passkeys are not supported, try a current browser, device, or password manager that supports passkeys.
• If a passkey is rejected as not registered for this site, make sure the correct passkey was selected. If the site hostname changed, ask an administrator to check the Passkey Credential Domain and Allowed Passkey Hostnames settings.
• If Wordfence reports an invalid passkey sign-in counter, the passkey may need to be removed and added again. Some authenticators report sign-in counters differently, and administrators can adjust the passkey sign-in counter validation setting from Login Security Options.
• If a user is locked out because passkeys are required but no passkey is registered, an administrator can reset the user’s grace period, change the role requirement, or use WP-CLI to help recover access. Administrators can remove a user’s registered passkeys, but the user must register any new passkeys themselves.
• When using plugins or themes that affect the WordPress login process, test for compatibility before enabling passkeys for other users.
• Staging and development sites that have a different domain name from the main site cannot share passkeys with the live site. Be sure not to use staging site’s hostname in the “Passkey Credential Domain” setting when pushing changes to production.

Passkey Settings and Administration

See the Login Security Options page for details on settings and managing passkeys for users.