New technologies, WordPress ·
WordPress Passkeys: What They Are and Should You Use Them?
By Manu Mathew, Technical Lead Engineer · Published 23 October 2026 · Last updated 23 October 2026
Your phone now offers to “create a passkey” when you sign in to your email, your bank or an online shop. Then you wonder whether your own website could work the same way, so that nobody needs to remember the WordPress admin password.
It can, with a little care. This post explains what WordPress passkeys are, what they protect against, how to add them to a site today, and the checks worth making before you switch them on.
Quick answer
A passkey lets you sign in with your device’s screen lock, such as a fingerprint, face scan or PIN, instead of typing a password. WordPress doesn’t include passkeys yet, but a well-maintained plugin can add them. They are worth it for admin accounts, as long as you keep a backup way to sign in.
What is a passkey?
A passkey is a sign-in key stored on your phone, laptop or password manager, which you open with your screen lock.
When you create one, your device makes a pair of matching keys. The private key stays with you, and the website stores only the public key. When you sign in, your device proves it holds the private key, and the site checks that proof against what it stored.
Two details matter for a site owner:
- Nothing secret is stored on your website. If someone copied your site’s database, they would find public keys, which are no use for signing in.
- A passkey only works on the site it was made for. Your device checks the web address before it answers, so a fake login page on a look-alike domain gets nothing.
Google’s web.dev guide to passkeys explains the technical side well. The standard underneath is called WebAuthn, and most current browsers support it.
How is a passkey different from a password and two-factor codes?
A passkey can’t be guessed, reused on another site or typed into a fake page, which is where most password problems start.
| Sign-in method | What you do | Main weakness |
|---|---|---|
| Password only | Type something you remember | Can be guessed, reused, leaked or phished |
| Password plus app code | Type a password and a six-digit code | Codes can still be typed into a fake page |
| Passkey | Confirm with your fingerprint, face or PIN | Needs a backup plan if you lose the device |
Two-factor codes are still a big step up from a password alone, and I’d keep them for any account that can’t use a passkey yet. Passkeys go one step further because there is nothing for a person to copy or hand over.
Does WordPress support passkeys?
Not on its own yet: WordPress core still signs people in with a username and password, so passkeys come from a plugin.
The official WordPress guidance on protecting against brute force attacks says core doesn’t include two-factor sign-in, and suggests adding passkeys through a maintained plugin. A request to build optional passkey support into core has been opened, but it hasn’t been accepted or scheduled.
In practice, that leaves two common set-ups:
- Passkey as a second step. You still enter your password, then confirm with your passkey instead of an app code. This is the gentlest change.
- Passwordless sign-in. You choose your passkey straight away and skip the password. This is more convenient, but you should keep a tested backup method.
The Two Factor plugin maintained by WordPress contributors suggests a separate add-on for passkeys and security keys. Whatever you choose, look at how recently it was updated, which WordPress versions it’s tested with and how its support forum is answered.
Should a small business website use passkeys?
For the accounts that can change your site, yes; for visitors and customers, it’s usually too early to require them.
Passkeys make most sense for:
- Administrators and editors. These accounts can install plugins, change pages and read enquiries, so they are the ones attackers want.
- Shared teams. Each person has their own passkey on their own device, which is safer than a shared password in a chat message.
- Sites that have been hacked before. Phishing and reused passwords are common ways in, and passkeys close both. If that has already happened to you, my guide to what to do with a hacked WordPress site covers the clean-up first.
I’d be slower to require passkeys for shop customers or members. Many people still don’t know what a passkey is, and a confusing sign-in costs you sales. Offering it as an option is fine; forcing it is a bigger decision.
What should you check before switching passkeys on?
The main risk is locking yourself out, so plan the way back in before you change anything.
- Take a backup of the site and database, and know how to restore it.
- Try it on a staging copy first, so a broken sign-in doesn’t happen on the live site.
- Register at least two passkeys for each administrator, for example on a phone and a laptop, or one on a hardware security key.
- Keep backup codes somewhere safe and offline, in case every device is lost.
- Check hosting access. Make sure someone can still reach the hosting control panel or server if the WordPress sign-in fails.
- Plan for a domain change. A passkey belongs to a domain, so if you move the site to a new domain, people will need to register their passkeys again.
How do I set up WordPress passkeys for a client?
I start with the people who sign in, then change one account at a time, with a way back at each step.
My usual order of work:
- List the accounts. I check who has administrator or editor access and remove any accounts that are no longer needed.
- Agree the approach in writing. Passkey as a second step or as passwordless sign-in, which roles it covers, and what happens if someone loses their phone.
- Choose and test the plugin on staging. I check its update history and try sign-in on the browsers and devices the team actually uses.
- Roll out to one account first. Usually the owner’s, while a second administrator stays on the old method as a safety net.
- Write a short how-to. A few plain steps for adding a passkey and what to do if a device is lost or replaced.
- Review it later. A month on, I check that everyone has enrolled and that old passwords are no longer the only way in.
It’s the same habit I use at work for any change to how people sign in: small steps, one rollback plan, and nobody surprised.
Frequently asked questions
What happens if I lose the phone that holds my passkey?
If your passkey was saved in a password manager that syncs, such as the ones built into phones and browsers, it usually comes back on your new device. If it was stored only on the lost device, sign in with a second passkey or a backup code, then remove the old passkey from your profile.
Are passkeys safe if my phone is stolen?
A thief would also need to get past your screen lock, because the passkey only works after your fingerprint, face or PIN. Even so, remove the lost device’s passkey from your WordPress profile as soon as you can, and change any shared passwords the phone held.
Do passkeys work on every browser and device?
Most current browsers and phone systems support passkeys, though older devices may not. Before you require passkeys, check the browsers and devices your team actually uses, and keep another way to sign in for anyone who can’t create one yet.
Can I still use my WordPress password after adding a passkey?
Usually yes. Most plugins keep password sign-in as a fallback, and some let you turn it off for chosen roles. Leaving a password route open is reasonable at first, as long as that password is long, unique and protected by a second step.
Will passkeys slow my website down?
No. A passkey is only used on the sign-in page, so it doesn’t affect how quickly visitors load your pages. The extra code from a passkey plugin runs at sign-in, and a well-built plugin adds very little to the rest of the site.
Want help securing your WordPress sign-in?
Whether you’d like passkeys set up, a review of who has access to your site, or wider help with security, I’m happy to talk it through. The WordPress websites page covers the kinds of work I take on.
You can reach me through the contact section or email me at manu@manu.co.in. Tell me a little about your business and the site, and we’ll go from there.