Add passkeys to WordPress login

To add passkeys to WordPress login, you install a maintained WebAuthn or passkey plugin, enroll a credential on the real site over HTTPS, and keep a recovery path before you require them. A passkey stores a public key on the site and a private key on your phone, laptop, or hardware key. It is not a password manager filling wp-login.php, and it is not ordinary two-factor with extra clicks. AutoSSL on WordPress hosting already provides HTTPS when the domain points here.

Choose one plugin and a recovery path

Core WordPress has been adding WebAuthn pieces over recent releases, but most production sites still use one maintained plugin from wordpress.org. Install from the official directory rather than a random zip. Use a single passkey or two-factor plugin so several security suites are not fighting over wp-login.php.

Before anyone enrolls a passkey, set a recovery code, a second device, or a password that still works for the admin account. A single passkey on one laptop with no backup can lock you out after a lost device. Store recovery material in the password manager you already trust.

Enroll on HTTPS on the real hostname

1. Log in with the password you still have.
2. Open the plugin’s security or passkeys screen, often under your profile.
3. Add a passkey. The browser may offer iCloud Keychain, Google Password Manager, Windows Hello, or a USB security key.
4. Sign out, then sign in with the passkey from a second browser window.
5. Only after that test should you require passkeys for administrators.

A hardware FIDO2 key survives a phone swap, and a phone backup helps if the stick is lost. Two factors of recovery beat one. Apple documents passkeys at developer.apple.com/passkeys; the WebAuthn rules are fixed, and the plugin is the glue inside WordPress.

If login breaks after enrollment

In File Manager, rename the plugin folder so WordPress stops loading it. wp-login.php then falls back to passwords, much like recovering from a critical error. Confirm FTP, SFTP, or the hosting panel still works before you require passkeys for the only administrator.

# on a VPS, from the WordPress root
wp plugin deactivate the-passkey-plugin –skip-plugins

XML-RPC and application passwords are separate doors. A passkey on wp-login.php does not close xmlrpc.php. If you need that locked down, see XML-RPC and application passwords.

WordPress passkeys are WebAuthn on the real hostname with a recovery path you can reach. Enroll, test a second device, then tighten the policy. For the control panel itself, see cPanel 2FA without lockout.