Advanced Passkeys for Secure Login

Description

Passwords are the single biggest security risk for your WordPress site. They get leaked, reused, or broken by automated brute-force attacks. Standard Two-Factor Authentication (2FA) adds safety, but typing in temporary codes from SMS or authenticator apps introduces annoying friction to your daily workflow.

Advanced Passkeys for Secure Login brings the future of un-phishable, modern authentication directly to your WordPress site using the official FIDO2 / WebAuthn standard.

Users register a passkey just once using their device’s built-in biometric sensor (Face ID, Touch ID, Windows Hello) or a hardware security key (like a YubiKey). Future sign-ins take less than a second—completely bypassing the traditional password field.

Why Switch to Passkeys?

• Immune to Phishing: Passkeys are cryptographically bound to your specific domain. A fake login page cannot trick or steal a passkey.
• Goodbye Brute-Force: Because there is no static password on the server to guess, automated bot attacks are completely neutralized.
• Ultimate Ecosystem Sync: Works seamlessly with iCloud Keychain, Google Password Manager, and 1Password for painless cross-device access.

Ecosystem-Wide Integrations Included

Unlike basic alternatives, this plugin features intelligent, dependency-aware integration modules that automatically inject passkey entry points into your favorite plugins. It features out-of-the-box support for WooCommerce, Easy Digital Downloads, MemberPress, Ultimate Member, LearnDash, BuddyBoss, Gravity Forms, and PMPro.

Features

• One-Click Passwordless Auth: Adds a native “Sign in with Passkey” button directly to the WordPress login screen.
• Conditional UI Autofill: Optional browser-native passkey autofill prompts on wp-login.php when username is focused.
• Ecosystem Integrations: Built-in aware modules, blocks, and shortcodes for WooCommerce, MemberPress, LearnDash, BuddyBoss, and more.
• Gutenberg Blocks & Shortcodes: Automatically registers custom login cards and shortcodes based on active plugins.
• Theme Template Overrides: Override the login button template via /advanced-passkeys/login/button.php in your active theme.
• Admin Dashboard Overview: Keep track of credential performance with an Authenticator Overview card and Last Login activity logs.
• Granular Role Controls: Easily configure exactly which user roles are permitted to use passkey authentication (Default: Administrators).
• Code-Managed Configuration: Developers can hardcode passkey settings via PHP for high-velocity agency, multisite, and version-controlled deployments.
• Brute-Force Rate Limiting: Hardened local security with built-in login rate-limiting and automated daily log cleanups.
• Multisite Compatible: Network-aware provisioning instantly configures security settings for newly created network sites.
• Clean Performance & Housekeeping: Lightweight footprint with a clean uninstall routine that leaves zero orphaned tables or options behind.

Developer Configuration

Advanced Passkeys supports code-managed configuration for developers, agencies, and teams that deploy WordPress settings through version control. This is useful when you need the same passkey policy across many sites without relying on manual database option changes.

Evaluation order

When the plugin resolves a setting, it uses this order:

1. advapafo_local_configuration filter
2. ADVAPAFO_SETTINGS constant
3. advapafo_settings option array
4. Existing individual advapafo_* database option
5. Plugin default

Code-managed values are resolved per setting key. If you override only challenge_ttl, the remaining settings continue to fall back to the database or plugin defaults.

Managed admin fields

When a setting is provided by advapafo_local_configuration or ADVAPAFO_SETTINGS, the matching admin control is locked and marked Managed via code. This prevents accidental dashboard edits from implying that a database value controls a setting that is actually dictated by PHP.

Example: force HTTPS and administrator-only passkeys

Add this to a small functionality plugin or your theme’s functions.php:

<?php
add_filter(
    'advapafo_local_configuration',
    static function ( array $configuration ): array {
        return array_replace(
            $configuration,
            array(
                'enforce_https'  => true,
                'eligible_roles' => array( 'administrator' ),
            )
        );
    }
);

Example: wp-config.php constant

For deployments that prefer constants, define an array in wp-config.php:

define(
    'ADVAPAFO_SETTINGS',
    array(
        'conditional_ui_enabled'     => true,
        'login_challenge_ttl'        => 300,
        'registration_challenge_ttl' => 300,
        'max_passkeys_per_user'      => 0,
    )
);

Common configuration keys

• enabled — enable or disable passkey features.
• eligible_roles — array of role slugs allowed to use passkeys.
• max_passkeys_per_user — maximum passkeys per user; 0 means unlimited.
• conditional_ui_enabled — enable browser-native passkey autofill on wp-login.php.
• show_separator — show or hide the login OR separator.
• challenge_ttl — shared challenge timeout fallback in seconds.
• login_challenge_ttl — login challenge timeout in seconds.
• registration_challenge_ttl — registration challenge timeout in seconds.
• user_verification — one of required, preferred, or discouraged.
• rp_name — custom relying party name.
• rp_id — custom relying party ID for domain/subdomain setups.
• rate_limit_window — failed-attempt tracking window in seconds.
• rate_limit_max_failures — failures allowed before lockout.
• rate_limit_lockout — lockout duration in seconds.
• login_redirect — fallback redirect URL after passkey login.
• last_used_pill_label — label for the login form’s Last used passkey indicator.
• last_used_pill_freshness_days — how long the Last used indicator remains fresh.

Last used pill example

<?php
add_filter(
    'advapafo_local_configuration',
    static function ( array $configuration ): array {
        $configuration['last_used_pill_label']          = 'Previously used';
        $configuration['last_used_pill_freshness_days'] = 120;

        return $configuration;
    }
);

Legacy filters

Legacy developer filters such as advapafo_max_passkeys_per_user, advapafo_enable_conditional_ui, and the Last used pill filters remain supported for backward compatibility. New code should prefer advapafo_local_configuration so configuration is centralized and easier to audit.

define( 'ADVAPAFO_ALLOW_HTTP', true ); (*Never use this in production!*)