# How to add passkeys to WordPress, and when to go passwordless

How to add passkeys to WordPress: what the site needs, setup for you and your team, the sign-in button, and when passwordless login is worth it.

By BetterShield Team, Oct 11, 2026. Updated Oct 26, 2026 by Nazmul Hasan Rupok.

This guide covers how to add passkeys to WordPress, for your own account, your team and your customers, and how to decide whether to go one step further and switch passwords off. A passkey signs you in with your fingerprint, your face or your device PIN. There is no reusable sign-in secret to type into the page. The browser binds the credential to the site, reducing phishing risk, while sessions and recovery accounts still need protection.

[WordPress two-factor authentication](/blog/wordpress-two-factor-authentication/) introduces passkeys alongside app codes. This post goes deeper: what the site needs, how passkeys count as a second factor, where the sign-in button appears, and the trade-offs of passwordless login.

## Quick summary

- A passkey is a key pair: your device keeps the private half, and the site stores only the public half.
- The site needs HTTPS. Current versions of Chrome, Safari, Edge and Firefox can all use passkeys.
- Add one on **BetterShield › Protection › Two-Factor**, your **Profile**, or **My Account › Sign-in security**: name the device, press **Add a passkey**, prove it is you when asked, and confirm.
- A passkey unlocked with a fingerprint, face or PIN counts as both factors. One that only asks for a touch does not.
- **Sign in with a passkey only** switches the password off for a role, but only for accounts that already hold a passkey.

## What a passkey is, and why it resists phishing

A password is a secret you share with the site: you type it, the site checks it, and anyone who learns it can use it. A passkey works differently. Your device creates a pair of keys for one site. The private key is never sent to the site; a synced passkey is managed by its provider and can become available on other authorized devices. It is unlocked by your fingerprint, face or PIN. The site keeps the public key, which can check a signature but cannot make one.

Two things follow. The stored public key cannot be used to produce a passkey signature. That does not make a database disclosure harmless; the database can contain other sensitive account and site data. And your browser only offers a passkey to the domain it was made for, so a convincing copy of your sign-in page on another domain gets nothing.

## What you need before you start

| Need | Why |
|---|---|
| HTTPS | Browsers refuse to create or use passkeys on plain HTTP. Without it, BetterShield's **Passkeys** card says so and stays off. Localhost works for development. |
| A server with the OpenSSL extension | It checks passkey signatures. The card says when it is missing. |
| A current browser | Chrome, Safari, Edge and Firefox all work. An older browser is told it cannot use passkeys. |
| A device that can unlock a passkey | A phone, a laptop with a fingerprint reader or PIN, or a security key. |

If your site is not on HTTPS yet, Findings shows **The site address is not HTTPS** (Critical on a live site). Fix that first; it matters for every sign-in, not only passkeys.

## WordPress passkeys setup: add your first one

People who manage BetterShield use the **Passkeys** card on **Protection › Two-Factor**. Everyone else uses **Passkeys** on their **Profile**, and store customers use **My Account › Sign-in security**. The steps are the same:

1. Type a name in **Name this device**, such as Work laptop.
2. Press **Add a passkey**. The button reads **Waiting for your device…**
3. Prove it is you when asked: a current code or backup code if you use two-factor, otherwise your password, or one of your passkeys if you sign in with a passkey only.
4. Confirm with your fingerprint, face or PIN.

The name matters on the day a device is lost, so name each passkey after the device or provider that holds it, noting when it is synchronized. If nothing asks you after a while, a password manager may be asking in its own window instead of the browser.

Add and test a separately enrolled fallback credential, ideally with a different recovery dependency. Each account holds up to 10, and a passkey is an extra way in: your password, backup codes and recovery link keep working exactly as before.

## Signing in with a passkey

Once any account on the site has a passkey, the WordPress sign-in page (wp-login.php) shows **Sign in with a passkey** below the **Log In** button. Press it and confirm on your device. You do not type a username: the browser offers the passkeys it holds for this site.

Every other sign-in rule still applies, such as lockouts, and **Remember Me** and the page you were heading to are kept.

How the device unlocked the passkey decides how much it proves:

| Unlocked with | No two-factor on the account | Two-factor on the account |
|---|---|---|
| Fingerprint, face or PIN | Signed in | Signed in, no code asked |
| Only a touch | Not accepted on its own | Goes on to the code screen |

A key that only asks for a touch proves someone is holding it, not who they are. That is enough as one factor of two, which is why a two-factor account still asks for the code.

The button is on wp-login.php only. A store's My Account form, a checkout and sign-in forms on other pages have none, so passkey users sign in on the site's own sign-in page.

## Passkeys for your team and customers

Nobody can add a passkey for someone else, because the device in front of each person makes it. So rolling passkeys out is a message, not a setting:

- **Where**: **Profile › Passkeys**, or **My Account › Sign-in security** for customers.
- **How many**: two, on two devices.
- **What changes**: nothing, unless their role is passkey-only (below).

Passkeys do not count toward **Require two-factor of a role**, which asks for app codes. If you require two-factor of a role, people in it set up the app as well; a passkey they unlock with a fingerprint, face or PIN then saves them typing the code. See [Enforce 2FA in WordPress](/blog/enforce-two-factor-wordpress/).

On a multisite network, sites on the network's own domain or its subdomains share passkeys, so one passkey works on all of them. A site on a domain of its own needs its own.

## Passwordless login in WordPress: passkey-only sign-in

**Sign in with a passkey only**, under **What the site requires** on **Protection › Two-Factor**, goes the last step: for the roles you tick, an account's password stops signing it in once that account holds a passkey. Removing ordinary password sign-in reduces the value of a stolen password on that route. Recovery and other credentials still need protection.

It includes several safeguards, which you should verify before rollout:

- **Nobody is refused without a passkey.** Accounts without one keep their password and see "This site asks accounts like yours to sign in with a passkey." with **Add a passkey** on their dashboard. There is no deadline.
- **A way back comes first.** Adding a role is refused unless the site has a working recovery link or printed recovery codes, and unless passkeys work on the site.
- **The first passkey has to check who you are.** For accounts in a ticked role, BetterShield asks the browser for a passkey the device unlocks with a fingerprint, face or PIN.
- **A refused password explains itself** and points to the passkey button, or to the site's sign-in page from any other form.
- **Password sign-in comes back** when the last passkey is removed, when the role is unticked, or for an hour of safe mode from the recovery link or a printed code.

Whether it is worth it depends on who is in the role:

| Who | Our advice |
|---|---|
| Administrators who all use passkeys already, on HTTPS | Worth it, once each holds two passkeys and the recovery link and printed codes are stored |
| Editors and authors | Wait until the coverage line under the setting shows everyone has one |
| Store customers and members | Leave off: they sign in on the store's form, which would send them to wp-login.php |
| Shared accounts | Leave off, and give each person their own account |

Application passwords keep working under passkey-only, so connected tools are not affected. A tool that signs in over XML-RPC with the account password needs an [application password](/blog/wordpress-application-passwords/). [Passkey-only sign-in](/docs/passkey-only-sign-in/) lists every safeguard and message.

## Removing a passkey, and a lost device

Each passkey on **Protection › Two-Factor** shows when it was last used. **Remove** asks first, then deletes it. On the profile and My Account, **Remove** sits beside each name.

Removing a passkey signs the account out on every other device, and the browser you removed it from stays signed in. That is what you want when a device is lost: remove its passkey from a device you still have, and anything the lost one was signed in to is signed out.

If the lost device held your only passkey and your role is passkey-only, use your recovery link or a printed recovery code. Safe mode lets you sign in with your password for an hour; add a new passkey or remove the lost one while it lasts. [Locked out of WordPress?](/blog/locked-out-of-wordpress/) covers the recovery link step by step.

## Test the failure you are planning for

Before enabling passkey-only sign-in, decide what losing a device actually means for this account. A passkey synchronized through one provider may be available on a second device, but access can still depend on that provider account. Two devices showing the same synchronized passkey are not necessarily two separately registered credentials.

Use this acceptance check:

1. Sign in with the everyday passkey in a separate browser session.
2. Put that device aside and prove a different recovery route works. If using a security key as the fallback, enroll and test that key separately.
3. Confirm the site password and recovery material are available outside the missing device. Backup codes replace an app-code step; they are not a direct substitute for a passkey-only requirement.
4. Confirm where users will sign in. BetterShield's passkey button is on the site's sign-in page, so a store's custom flow needs its own check.

**Worked example (fictional):** an administrator has a synced passkey on a phone and laptop, plus a separately enrolled security key stored securely. Before retiring the phone, the administrator tests the key and checks which registered credential belongs to the synced provider. Removing that credential from WordPress can revoke all its synced copies, not just the phone copy.

Passkeys reduce phishing risk at authentication. They do not protect an already stolen session or secure the mailbox and provider account used for recovery. Review those paths when a device is lost.

## Common mistakes

- **One passkey on one device.** Lose the device and you lose that way in. Add a second.
- **Unnamed or vague names.** "Passkey" twice tells you nothing when one has to go. Name the device.
- **Switching on passkey-only before people have passkeys.** It changes nothing for them yet, but the point is lost. Watch the coverage line first.
- **Expecting a passkey to satisfy a two-factor requirement.** It asks for app codes.
- **Looking for the button on a store's login form.** It is on wp-login.php only.

## Frequently asked questions

### Are passkeys part of the free plugin?

Yes. Passkeys, the **Sign in with a passkey** button and passkey-only sign-in are all in the free BetterShield plugin, with no account needed.

### Is a passkey the same as two-factor authentication?

A passkey unlocked with a fingerprint, face or PIN counts as both factors, so a two-factor account signs in without a code. A key that only asks for a touch counts as one factor. A passkey does not satisfy a two-factor requirement by role.

### What happens if I lose my phone with my passkey on it?

Sign in with another passkey, your password plus its second factor when password sign-in is allowed, then remove the lost credential. If your role is passkey-only and it was your only passkey, your recovery link or a printed recovery code gets you in.

### Can customers use passkeys on a WooCommerce store?

Yes. They add them under **My Account › Sign-in security** and sign in with them on the site's sign-in page.

## Conclusion

Adding a passkey takes a name and a fingerprint, and it leaves everything else as it was. Start with your own account on two devices, ask your team to do the same from their profile, and switch passwords off only for a role whose people all hold passkeys and whose way back is ready.

BetterShield is free on [WordPress.org](https://wordpress.org/plugins/bettershield/). The details are in [Passkeys](/docs/passkeys/).