How To Ask Roles to Add a Passkey with BetterShield Ultra?

3 min read

Remind selected WordPress roles to add a passkey and decide whether a verified passkey counts as both sign-in factors.

In BetterShield Ultra, Passkeys by role on BetterShield › Ultra › Sign-in rules reminds people in selected roles to add a passkey.

Note: These controls require the paid BetterShield Ultra add-on alongside the free BetterShield plugin.

What it does

The selected roles see a dashboard reminder until they hold a passkey. It is a reminder, not a sign-in block. Password sign-in still works unless another BetterShield policy requires passkey-only sign-in.

Open BetterShield › Ultra › Sign-in rules.

BetterShield Ultra Passkeys by role card with role checkboxes and the both-factors option. — The role reminder is off by default; a verified passkey counts as both factors by default.

Step 2: Ask roles to add a passkey

Under Passkeys by role, tick the roles. None are ticked by default.
Set Skip the extra code for passkeys unlocked with a fingerprint, face or PIN. It is on by default.
Select Save policies.

When passkeys are unavailable on the site, saved role reminders pause until passkeys work again.

Optional passkey-only date

For a selected role, Passkey-only sign-in for… starts on can set a date. From that date, people in the role who already have a passkey must use it; people without one can still use their password until they add a passkey. This is different from directly requiring passkey-only sign-in under Protection › Two-Factor. Read that screen’s warning when both policies apply.

Use Allow Passwords Again for a role to stop the Ultra deadline’s passkey-only behavior. Confirm recovery before choosing a date. If passkeys are unavailable, the screen reports the pause and keeps checking rather than enforcing an unusable sign-in path.

Recommended settings

Our advice:

Start with administrators and people who sign in often.
Leave the both-factors option on for verified device passkeys unless policy requires a separate code.
Confirm HTTPS and browser support before selecting many roles.

What it can break and how to undo

The reminder does not block password sign-in. Turning off the both-factors option makes two-factor accounts enter a code after passkey sign-in.

Untick roles or restore the previous factor choice and save.

Final Outcome

The card shows the selected roles.

A person in one of those roles without a passkey sees the reminder.
The reminder disappears after they add a passkey.

On multisite

Each site keeps its own reminder policy. Network passkey-only roles remain a separate policy.

This is how you can ask roles to add a passkey.

Getting Stuck? Feel free to contact our Dedicated Support Team.