Passkey-only sign-in in WordPress: turn passwords off by role
Passkey-only sign-in in WordPress stops the password from signing in the accounts of the roles you pick, once each account holds a passkey. BetterShield calls the setting Sign in with a passkey only. It is the one setting on the Two-Factor tab that takes a way in away, so it comes with more safeguards than any other, and this guide goes through each of them, starting with the way back in.
If you have not added a passkey yet, start with how to add passkeys to WordPress. This post covers the next step: making a passkey the only way in for a role, and keeping your own door open while you do.
Quick summary
- Sign in with a passkey only applies account by account. An account in a ticked role stops signing in with its password once it holds a passkey usable at this address.
- Accounts without a passkey keep their password, with no deadline and no grace period.
- It cannot be switched on without a way back in: a working recovery link or unused printed recovery codes.
- It stands aside if passkeys stop working on the site, for example when HTTPS is lost, so passwords sign in again.
- Undo it by unticking the role and pressing Save Requirement.
Why turn passwords off
A password can be guessed, reused from someone else’s breach or typed into a copy of your sign-in page. A passkey is a key your device keeps and unlocks with a fingerprint, face or PIN. The site stores only the public half, and the browser offers it only to the site’s own domain.
When a role signs in with a passkey only, a password stops being something to steal. That makes the most sense for the roles with the most power. It also removes the main reason to lock people out for guessing, because a guess no longer gets anywhere. Our guide to WordPress two-factor authentication covers the other half of the picture, the codes that protect an account that still uses a password.
What it does
- It applies account by account. An account in a ticked role that holds a passkey usable at this address can no longer sign in with its password, on any form.
- Accounts without a passkey keep their password, for as long as they need. Each dashboard page tells them: “This site asks accounts like yours to sign in with a passkey.” with an Add a passkey button.
- Adding the first passkey is what switches the password off. The profile then says the account signs in with a passkey, so the password no longer signs in, and asks the person to keep at least one passkey on a device they have to hand.
- Application passwords keep working, so tools that need one are not cut off.
What people see when a password is refused
| Where | What happens |
|---|---|
| The site’s sign-in page (wp-login.php) | A message says the account signs in with a passkey and points to the Sign in with a passkey button. It adds that a recovery link or a printed recovery code restores password sign-in. |
| Any other form, such as a store’s My Account or checkout | A message says the form cannot take a passkey and links to the site’s sign-in page, with the same way back. |
| XML-RPC | WordPress’s own “Incorrect username or password.”, the same answer a wrong password gets. Tools need an application password. |
For an account that does not manage BetterShield, the message tells the person to ask an administrator to remove the passkey from their account, and the password will work again.
The passkey button is on wp-login.php only. A passkey that asks only for a touch cannot sign these accounts in on its own. On an account that also has two-factor, it goes on to the code screen.
Set it up
Do the recovery step first. It is the one thing the setting will not let you skip.
- Have a way back in ready: a working recovery link, or unused printed recovery codes, on BetterShield › Protection › Recovery. The recovery setup guide walks through both, and locked out of WordPress shows what using them looks like.
- Open BetterShield › Protection › Two-Factor and find What the site requires.
- Tick the roles under Sign in with a passkey only.
- Press Save Requirement.
| Option | What it does | Default |
|---|---|---|
| Roles | Accounts in each ticked role sign in with a passkey once they have one. Every role on the site is listed. | None ticked |
Under the roles, a line per ticked role says how many of its accounts have a passkey, counted up to the first 200, or that nobody holds the role. Use it to see who is covered before anyone is affected.
The safeguards
Each of these is in the doc, and each is there so that switching passwords off does not switch you off too.
- Nobody is refused until they hold a working passkey. Ticking a role changes nothing for an account that has none.
- A way back first. Adding a role is refused without one: “Generate a fresh recovery link first, or issue a set of printed codes.” An expired link, or one whose email could not be sent, does not count. There is no going ahead anyway.
- Only where passkeys work. Adding a role is refused while passkeys are off on the site, with the reason.
- It stands aside if passkeys stop working. If the site loses HTTPS later, passwords sign in again. The card says the requirement is not in effect, and you can still take the roles out.
- Taking a role out is never refused, except a role the network requires on multisite.
- A first passkey that checks who you are. For an account in a ticked role, BetterShield asks the browser for a first passkey the device unlocks with a fingerprint, face or PIN, because that passkey will replace the password.
- No lockouts for the right password. A refused password does not count toward the sign-in lockout, and these accounts are never asked to confirm a password they cannot use.
- Safe mode stands it down, as it does every sign-in protection.
How password sign-in comes back
| Way | For how long |
|---|---|
| The person removes their last passkey, signed in, on their profile | Until they add one again |
| An administrator removes their passkeys on the Edit user screen | Until they add one again |
| An administrator unticks the role, or moves the person to a role that is not ticked | For good |
| The recovery link or a printed recovery code | While safe mode lasts, an hour by default. Sign in with the password, then add a new passkey or remove the lost one. |
| Passkeys stop working on the site | While they are off |
To help one person who lost their device, an administrator removes all of that account’s passkeys from the Edit user screen. Their password works again until they add a new passkey.
What it can break, and how to undo
- Store customers in a ticked role, once they add a passkey, are refused on the store’s own form and must use wp-login.php. The screen says so when you tick a role that WooCommerce keeps out of the dashboard.
- Sign-ins another plugin completes without a password, through WordPress’s sign-in step, are refused for these accounts too.
- Tools using the account password over XML-RPC need an application password.
To undo it, untick the role and press Save Requirement. With Ask for my password before removing a protection on, it asks for your password first.
Check it is working
- The Passkey-only sign-in for tile names the roles, and the coverage line shows who is covered.
- The activity log records Passkey-only requirement changed (High, emailed as it happens when instant alerts are enabled) and Password refused: this account uses a passkey (Medium, the first per account each hour). A repeated refusal is logged as High at the tenth within an hour, and it means someone holds that password.
- A finding warns when the recovery link is close to expiring while passwords are switched off. It appears in the link’s last 14 days and stays once it has expired, so generate a new link on Protection › Recovery.
On multisite
Passkey-only roles across the network, on BetterShield › Network, is a floor for every site. Adding a role checks every site and is refused while any has no working recovery link and no printed codes, and the message names the first such site. A site cannot untick a role the network requires. A network with more than 200 sites cannot add a role there, because not every site could be checked. See the multisite security guide for the wider picture.
Recommended settings
We recommend leaving it off until the people in a role already sign in with passkeys. Then turn it on for Administrator, when:
- the site is on HTTPS,
- every administrator holds at least two passkeys that their devices unlock with a fingerprint, face or PIN, which the coverage line shows,
- your recovery link is stored in a password manager and your printed codes are printed.
| Site | What we recommend |
|---|---|
| Store (WooCommerce) | Leave Customer unticked. Customers sign in on the store’s own form, which would send them to wp-login.php. |
| Membership or course site | Leave member roles unticked, for the same reason. |
| Agency or many sites | Only roles your own team holds, and only once every site has its own recovery link or printed codes. Client staff in the same role are covered too, so wait until they have passkeys. |
Keep shared accounts out of passkey-only roles. If you want to understand the standard behind passkeys, WebAuthn is the web standard that browsers use for them.
Frequently asked questions
Does passkey-only sign-in lock out people who have no passkey yet?
No. An account keeps its password until it holds a passkey. Each of its dashboard pages shows a notice with an Add a passkey button, and there is no deadline or grace period.
What if someone loses the device that holds their passkey?
An administrator removes all of that account’s passkeys on its Edit user screen, and their password works again until they add a new passkey. The person can also use a recovery link or a printed recovery code.
Can I turn it on without a recovery link?
No. Adding a role is refused until you have a working recovery link or unused printed codes. An expired link does not count.
Does it stop application passwords?
No. Application passwords keep working, which is how tools that cannot use a passkey stay connected.
Is passkey-only sign-in part of the free plugin?
Yes. Passkeys and passkey-only sign-in by role are in the free BetterShield plugin on WordPress.org, with no account needed.
Conclusion
Passkey-only sign-in takes the password out of the roles you pick, one account at a time, and only once that account holds a working passkey. Set up your recovery link or printed codes first, start with Administrator, and untick the role if you ever need to go back.
BetterShield is free on WordPress.org. The full reference is the Passkey-only sign-in guide.