Rapls Passkey Manual (Free Edition)

How to replace the WordPress password login with passkeys (WebAuthn / FIDO2) using the free plugin.
Version: 0.13.78 | PHP 8.2+ | WordPress 6.0+

What Is Rapls Passkey

Rapls Passkey lets users sign in to WordPress with passkeys (WebAuthn / FIDO2). It brings passwordless, phishing-resistant sign-in to your site with no external service to sign up for.

• Passwordless and phishing-resistant: The user is verified by the biometrics or screen lock built into their own device — no password to type.
• Same-device passkeys: Use the authentication your device already has — Touch ID, Windows Hello, Face ID, and more.
• Sign in from another device: When the browser supports it, sign in by scanning with your phone using the browser’s own native passkey flow. (A dedicated QR approval flow is a Pro feature.)
• Passwords are never removed: The existing password login stays exactly as it was. Passkeys are added alongside — nothing is taken away.
• Japanese included: The UI is sourced in English and fully translated into Japanese. Translations are not bundled with the plugin; WordPress.org delivers them as language packs from translate.wordpress.org, and every string is translatable.

Requirements & HTTPS

To use Rapls Passkey you need the following environment.

About the Relying-party ID (RP ID)

A passkey is bound to the domain of the site it was registered on — the relying-party ID (RP ID). By default the site’s hostname is used as-is, so no configuration is normally needed. If the RP ID changes later, every previously registered passkey stops matching and can no longer sign in, so it is important to settle your domain before going live. If you need a shared RP ID (for example on multisite), set it with the rapls_passkey_rp_id / rapls_passkey_rp_name filters — the value must be the host or a registrable parent domain.

Install & Activate

Rapls Passkey is distributed from the official WordPress.org directory.

1. Open Plugins > Add New in your WordPress admin.
2. Search for “Rapls Passkey“.
3. Click Install Now on Rapls Passkey, then Activate.
4. After activation, a settings screen appears under Settings > Rapls Passkey. The plugin’s row on the Plugins screen also gets a Settings link.

To install from a ZIP file manually, use Plugins > Add New > Upload Plugin and choose the ZIP.

First-run Setup Check

Activating a passkey plugin and landing on a settings screen leaves the two questions that actually decide whether passkeys will work unanswered. Rapls Passkey answers them with a setup check (wizard) that appears once on first run.

• Is the site served over HTTPS? As noted above, browsers refuse passkeys without it.
• Which RP ID will passkeys bind to? Get it wrong later and every registered passkey stops matching, so it is confirmed up front.
• Coexistence with security plugins: The wizard notes any security plugin it is running alongside and flags anything to watch for.
• The administrator’s own passkey: An administrator who has never tried it cannot tell whether it works for anyone else, so the wizard walks you through registering one.

Register Your First Passkey

Each user registers their own passkeys from their profile screen.

1. Open Users > Profile in the admin.
2. Scroll to the “Passkeys” section.
3. Click Register a passkey.
4. When the browser / OS dialog appears, verify yourself with your fingerprint, face, screen lock, or a security key.
5. Give the passkey a recognizable name and save it (e.g., “Work MacBook”, “YubiKey”).

Once registered, the passkey is added to the list on your profile screen. The list shows the name, the authenticator (the provider derived from the AAGUID — iCloud Keychain, Google Password Manager, Windows Hello, 1Password, YubiKey, and more), the registration date, and the last-used date.

Sign In with a Passkey

Once a passkey is registered, a “Sign in with a passkey” button appears on the WordPress login screen (wp-login.php).

Same-device Sign-in

The most common flow: sign in on the same device where the passkey is registered.

1. On the login screen, click Sign in with a passkey.
2. In the browser dialog, verify yourself with your fingerprint, face, or screen lock.
3. Once verified, you are signed in.

On supporting browsers you can sign in with just the button, without typing a username (usernameless / autofill). The browser may also offer your registered passkeys as suggestions when you focus the username field (Conditional UI).

If a sign-in fails, the message says why — a connection problem, a cancelled prompt, or a site that is not served over HTTPS — instead of a single “authentication failed”. A login page left open for a long time keeps working: the sign-in attempt it holds open is refreshed before the server stops recognising it.

Sign In from Another Device

Even if the computer in front of you has no passkey registered, you can sign in with a passkey on your phone. This uses the cross-device feature that the browser / OS provides natively.

1. On the computer’s login screen, click Sign in with a passkey.
2. From the browser’s options, choose “another device”, “phone”, or similar.
3. Scan the QR code shown on screen with your phone’s camera.
4. Approve with a passkey on your phone, and the sign-in on the computer completes.

Rename a Passkey

You can rename a passkey after registration. The name used to be fixed at registration time, which left a user with two “iCloud Keychain” entries no way to tell which one to revoke after losing a device. Renaming solves that.

Rename from the profile screen or the [rapls_passkey_register] management UI. Renaming is owner-only and is recorded in the audit log.

Suspend & Resume a Passkey

A passkey can be suspended instead of deleted. A device that is at the repair shop or left at the office does not need its credential destroyed and re-registered later.

• A suspended passkey is refused at login and is not offered to the browser, but it survives and can be resumed later.
• Users manage their own passkeys from the profile screen and the [rapls_passkey_register] shortcode. An administrator can suspend anyone’s.
• A suspended passkey does not count as “having a passkey”, so even a configuration with password login disabled cannot strand a user with nothing to sign in with.

Embedding on Your Site

The login button and passkey-management UI can be embedded on any page, post, or widget as shortcodes or Gutenberg blocks. Handy for a members’ account page or a dedicated login page.

Shortcodes

Examples:

[rapls_passkey_login redirect="/dashboard/" label="Sign in with a passkey"]

[rapls_passkey_register]

Gutenberg Blocks

In the block editor the same features are available as the “Sign in with a passkey” block and the “Manage passkeys” block. Each block’s sidebar panel lets you set the redirect URL and the button label.

Site-wide Passkey List

Administrators can review every passkey on the site under Users > Passkeys. Answering “who still has a passkey on the laptop we just lost?” no longer means opening user profiles one at a time.

The list is searchable by owner or passkey name and shows:

• The owner and authenticator (provider)
• When it was registered
• When it was last used (or “never”)
• Its status (active / suspended)

You can suspend or delete any passkey in place from the list.

Users List Passkey Column

Users > All Users also gains a “Passkey” column showing, per user, how many passkeys they have registered, the last-used time, or that they have none.

Admin Enrolment

An administrator can register a passkey on another user’s behalf — for handing over a pre-configured security key or setting someone up in person.

• On by default. This is a feature of the free plugin and needs no Pro licence. To switch it off, clear Rapls Passkey Pro > Administrator enrolment on sites with Pro, or return false from the rapls_passkey/allow_admin_enrolment filter.
• It gives an administrator no new power: someone who can edit that user can already reset their password and sign in as them. The passkey is created on whichever authenticator is present at that moment — the administrator’s — so the administrator ends up holding a credential to that account.
• Only administrators with the edit_user capability for that specific user can do it.
• The enrolment is emailed to the account’s owner and recorded in the audit log.

2FA Plugin Coexistence

Rapls Passkey works alongside SiteGuard WP Plugin, CloudSecure WP Security, Wordfence (Login Security), and Two-Factor. It is designed to coexist with both login-hardening plugins and two-factor (2FA) plugins.

SiteGuard / CloudSecure WP Security and other login-hardening plugins: Rapls Passkey uses only the standard login hooks, so a plugin that changes the login URL keeps doing so, and the passkey button appears on whatever login screen your site actually serves (the developer’s own site runs it this way with CloudSecure WP Security). If your security plugin restricts the REST API to logged-in users, passkey sign-in cannot start before anyone is logged in: turn on Passkey login when REST is restricted under Settings > Rapls Passkey > REST API. It is off by default, and when on it re-opens only the plugin’s own anonymous login routes, and only for a “must be logged in” (HTTP 401) restriction — a firewall, IP block or maintenance page (HTTP 403) is never overridden. The first-run setup check shows which security plugins were detected.

Wordfence Login Security / Two-Factor and other 2FA:

• A passkey counts as the second factor: A passkey sign-in is itself phishing-resistant multi-factor authentication (MFA), so it is never challenged again by a separate 2FA screen (the same applies to the cross-device QR flow and passkey sign-up).
• Weaker logins still pass the site’s 2FA: Logins via an email magic link or recovery code (Pro) set the session without going through the password chain, so they used to bypass the site’s 2FA. Those logins now stop at a two-factor challenge screen and complete only after the site’s own 2FA plugin verifies the code (using Wordfence’s own check, for example, rather than a re-implementation).

reCAPTCHA v3 & Login Rate Limit

reCAPTCHA v3 (Password Login Protection)

Protect the password login form with Google reCAPTCHA v3. It does not apply to passkey logins (brute force does not work against them).

1. Open the “reCAPTCHA v3” section under Settings > Rapls Passkey.
2. Enter the site key and secret key from Google reCAPTCHA.
3. Adjust the score threshold if needed (default 0.5).
4. Tick “Enable reCAPTCHA” and save.

Login Rate Limit

Limits the number of failed login attempts per IP address within a time window. Once the threshold is exceeded, the IP is locked out for the configured window.

• Only failed passkey assertions count toward the limit. The /login/options request that the browser legitimately makes several times per page for autofill is not counted.
• A successful sign-in clears the counter.
• The attempt limit and lockout time are adjustable on the settings screen (default: 30 attempts per 300 seconds). Setting the limit to 0 disables it.
• They can also be changed with the rapls_passkey_login_rate_max / rapls_passkey_login_rate_window filters.

Notifications & Audit Log

Rapls Passkey keeps users informed of important actions and records them so administrators can trace what happened.

• Security notification emails: Notify the user about passkey registration and removal, and about passkey sign-ins from a new device (can be disabled in settings, and controlled individually with filters).
• Audit log: Records registration, removal, rename, suspend, and sign-in events. Export it as CSV from the settings screen (UTF-8 with BOM for Excel; spreadsheet formula injection is neutralized).

Emergency Bypass

As a break-glass measure for when you cannot sign in with a passkey, add the following single line to wp-config.php to temporarily lift passkey enforcement and the two-factor challenge.

define( 'RAPLS_PASSKEY_BYPASS', true );

WP-CLI

Inspect and manage passkeys from the command line. Useful for automating operations and for server-side recovery when someone cannot sign in.

Examples:

# List the admin user's passkeys
wp rapls-passkey list --user=admin

# Remove passkey with id 12
wp rapls-passkey remove 12

# Show site-wide adoption
wp rapls-passkey stats

Site Health

Rapls Passkey adds self-checks to Tools > Site Health that confirm passkeys can work correctly.

• Whether the site is served over HTTPS
• Whether the WebAuthn library is loaded
• Whether the plugin’s database tables exist
• Whether the RP ID and security-plugin coexistence look correct
• Whether the object cache, when a persistent one is installed, actually returns a value written by an earlier request (Rapls Passkey: Object cache). Reload the Site Health screen once to confirm it

Passkey sign-in itself no longer depends on the object cache: the challenge a sign-in spans two requests with, and a login parked for a two-factor challenge, are stored in the database. The object-cache check is there because the rest of the site does depend on it — a cache that loses values between requests (an APCu cache too small for the site, or several PHP-FPM instances or servers that do not share one) makes anything spanning two requests fail at random.

An Info-tab panel is also added, which you can export when contacting support.

FAQ

Lost Your Passkey

Q: What if I lose my passkey and cannot sign in?

Password login works alongside passkeys, so sign in with your password as usual and then remove or re-register passkeys from your profile screen. You can also manage them from the server with WP-CLI (wp rapls-passkey list / remove). If you still cannot get in, add define( 'RAPLS_PASSKEY_BYPASS', true ); to wp-config.php. It switches off every passkey requirement and second-factor check this plugin applies; remove it once you have recovered.

Is HTTPS Required

Q: Can I use it on an HTTP site?

No. WebAuthn only works over HTTPS by browser policy. Passkey registration and sign-in are not possible on an HTTP site. The only exception is localhost for development.

Do Passwords Still Work

Q: Do passwords stop working once I add passkeys?

No. In the Free edition, password login stays exactly as it was. Passkeys are an additional option, and users can migrate at their own pace. Disabling password login and enforcing passkeys for a role are Rapls Passkey Pro features.

Using with 2FA

Q: Can I use it with a two-factor plugin?

Yes. It coexists with Wordfence Login Security, Two-Factor, and similar plugins. A passkey sign-in is treated as strong MFA and is not challenged again, while weaker logins such as password still have the site’s 2FA applied to them.

Multiple Devices & Limit

Q: Can one person register multiple passkeys?

Yes. You can register several passkeys — phone, computer, security key — so that losing one device does not lock you out. The per-user registration limit is adjustable on the settings screen.

Security Key Support

Q: Can I use a security key such as a YubiKey?

Yes. In addition to built-in authenticators like Touch ID, Windows Hello, and Face ID, external security keys (roaming authenticators) such as YubiKey are supported. The passkey list shows the authenticator’s provider (iCloud Keychain, Google Password Manager, Windows Hello, 1Password, YubiKey, and more).

Multisite

Q: Is multisite supported?

Yes. Use the rapls_passkey_rp_id / rapls_passkey_rp_name filters to set a shared RP ID. More advanced network-wide policy and shared-RP-ID management are Rapls Passkey Pro features.

Staging & Live Sites

Q: Will passkeys made on a staging site work on the live site?

Not by default. A passkey is bound to the domain it was registered on, and that binding is kept inside the authenticator, not in the database — so moving the database to production does not carry it across. A passkey registered on staging.example.com is not offered on example.com.

Either register again on the live site and treat staging passkeys as disposable, or have both sites use the parent domain as the RP ID before anyone registers:

add_filter( 'rapls_passkey_rp_id', function () {
    return 'example.com';
} );

With the second approach, passkeys registered on staging keep working once the database moves to production, including any you did not mean to keep. Passkeys made on localhost only ever work on localhost. The setup check shows the RP ID in use, so this can be settled before the first passkey is registered.

Upgrade to Pro

The Free edition is a complete passkey solution on its own, but Rapls Passkey Pro enables organization-wide rollout and stricter policy. Pro runs on top of the free Rapls Passkey plugin (0.13.74 or later) with it installed and active.

Until Pro is active, the settings screen shows a short Rapls Passkey Pro panel in its sidebar and the Plugins screen row has a Go Pro link. Nothing on the settings screen is locked or limited.

Added Features PRO

• Cross-device QR login: The computer shows a QR plus a 4-digit confirmation code; scan with your phone and approve with your passkey. The code blocks relay phishing, and it works even when the devices are far apart.
• Role-based passkey enforcement: Require a passkey for chosen roles with a grace period for a phased rollout. The last administrator, RAPLS_PASSKEY_BYPASS, and recovery codes prevent lockout.
• Single-use recovery codes: Break-glass sign-in when a passkey is unavailable.
• Email magic-link login and passwordless sign-up (create an account with a passkey alone).
• Adaptive step-up: Ask for a passkey again after a risky password login (untrusted device + unknown location), or on every password login.
• Withhold application passwords and refuse “Lost your password?” for users meant to be passwordless.
• Trusted-device management and a post-login enrolment prompt for users without a passkey.
• Authenticator policy: FIDO Metadata Service (MDS) certification checks and an AAGUID denylist.
• Security webhooks (Slack / Teams / generic JSON) and adoption reports (digest and reminder emails, analytics).
• Multisite network-wide policy and shared RP ID, settings export/import, and extended WP-CLI.