Rapls Passkey Manual (Free Edition)

How to replace the WordPress password login with passkeys (WebAuthn / FIDO2) using the free plugin.
Version: 0.13.62 | PHP 8.2+ | WordPress 6.0+

What is a passkey? Instead of a password, you sign in with your fingerprint, face, or device screen lock (Touch ID, Windows Hello, Face ID) or a security key. No shared secret is ever sent to the server, so passkeys are phishing-resistant and immune to password reuse and leaks. Rapls Passkey adds this passkey sign-in to WordPress.

What Is Rapls Passkey

Rapls Passkey lets users sign in to WordPress with passkeys (WebAuthn / FIDO2). It brings passwordless, phishing-resistant sign-in to your site with no external service to sign up for.

Passwordless and phishing-resistant: The user is verified by the biometrics or screen lock built into their own device — no password to type.
Same-device passkeys: Use the authentication your device already has — Touch ID, Windows Hello, Face ID, and more.
Sign in from another device: When the browser supports it, sign in by scanning with your phone using the browser’s own native passkey flow. (A dedicated QR approval flow is a Pro feature.)
Passwords are never removed: The existing password login stays exactly as it was. Passkeys are added alongside — nothing is taken away.
Japanese included: The UI is sourced in English with a bundled Japanese translation, and every string is translatable.

The Free edition stands on its own. Rapls Passkey Free is not a crippled trial. Registering, signing in with, and managing passkeys — plus 2FA-plugin coexistence, reCAPTCHA, WP-CLI, and the audit log — are all fully usable on their own. When you need more advanced operations, such as enforcing passkeys for a role or a cross-device QR login, consider Rapls Passkey Pro.

Requirements & HTTPS

To use Rapls Passkey you need the following environment.

Item	Requirement
WordPress	6.0 or later (latest recommended)
PHP	8.2 or later
Connection	HTTPS (except on `localhost`)

HTTPS is required. WebAuthn (the technology behind passkeys) only works over HTTPS by browser security policy. On an HTTP site, browsers refuse passkey registration and sign-in entirely. The only exception is localhost (loopback) for development. Hostnames like .local and .test are not exempted, so always serve a real site over HTTPS.

About the Relying-party ID (RP ID)

A passkey is bound to the domain of the site it was registered on — the relying-party ID (RP ID). By default the site’s hostname is used as-is, so no configuration is normally needed. If the RP ID changes later, every previously registered passkey stops matching and can no longer sign in, so it is important to settle your domain before going live. If you need a shared RP ID (for example on multisite), set it with the rapls_passkey_rp_id / rapls_passkey_rp_name filters — the value must be the host or a registrable parent domain.

Install & Activate

Rapls Passkey is distributed from the official WordPress.org directory.

Open Plugins > Add New in your WordPress admin.
Search for “Rapls Passkey“.
Click Install Now on Rapls Passkey, then Activate.
After activation, a settings screen appears under Settings > Rapls Passkey.

To install from a ZIP file manually, use Plugins > Add New > Upload Plugin and choose the ZIP.

Tip: Right after activating, register one passkey for yourself from your profile screen. Trying registration and sign-in yourself is the best way to confirm it will work for everyone else. The first-run setup check walks you through exactly this.

First-run Setup Check

Activating a passkey plugin and landing on a settings screen leaves the two questions that actually decide whether passkeys will work unanswered. Rapls Passkey answers them with a setup check (wizard) that appears once on first run.

Is the site served over HTTPS? As noted above, browsers refuse passkeys without it.
Which RP ID will passkeys bind to? Get it wrong later and every registered passkey stops matching, so it is confirmed up front.
Coexistence with security plugins: The wizard notes any security plugin it is running alongside and flags anything to watch for.
The administrator’s own passkey: An administrator who has never tried it cannot tell whether it works for anyone else, so the wizard walks you through registering one.

It appears only once. The setup check shows on first run and is reachable afterwards from “Setup check” on the settings screen. On a site that upgraded with passkeys already registered — a site that is plainly working — the notice does not appear.

Register Your First Passkey

Each user registers their own passkeys from their profile screen.

Open Users > Profile in the admin.
Scroll to the “Passkeys” section.
Click Register a passkey.
When the browser / OS dialog appears, verify yourself with your fingerprint, face, screen lock, or a security key.
Give the passkey a recognizable name and save it (e.g., “Work MacBook”, “YubiKey”).

Screenshot coming soon

Once registered, the passkey is added to the list on your profile screen. The list shows the name, the authenticator (the provider derived from the AAGUID — iCloud Keychain, Google Password Manager, Windows Hello, 1Password, YubiKey, and more), the registration date, and the last-used date.

Tip: Register more than one passkey so that losing a single device does not lock you out (for example, your phone plus a backup security key). The per-user registration limit is adjustable on the settings screen.

Once a passkey is registered, a “Sign in with a passkey” button appears on the WordPress login screen (wp-login.php).

Same-device Sign-in

The most common flow: sign in on the same device where the passkey is registered.

On the login screen, click Sign in with a passkey.
In the browser dialog, verify yourself with your fingerprint, face, or screen lock.
Once verified, you are signed in.

On supporting browsers you can sign in with just the button, without typing a username (usernameless / autofill). The browser may also offer your registered passkeys as suggestions when you focus the username field (Conditional UI).

Sign In from Another Device

Even if the computer in front of you has no passkey registered, you can sign in with a passkey on your phone. This uses the cross-device feature that the browser / OS provides natively.

On the computer’s login screen, click Sign in with a passkey.
From the browser’s options, choose “another device”, “phone”, or similar.
Scan the QR code shown on screen with your phone’s camera.
Approve with a passkey on your phone, and the sign-in on the computer completes.

Free vs. Pro: Free-edition cross-device sign-in relies on the standard QR flow supplied by the browser / OS (support depends on the browser). Rapls Passkey Pro adds a dedicated cross-device QR login: the computer shows a QR plus a 4-digit confirmation code, so you can approve from your phone even when the devices are far apart. The confirmation code blocks relay phishing.

Rename a Passkey

You can rename a passkey after registration. The name used to be fixed at registration time, which left a user with two “iCloud Keychain” entries no way to tell which one to revoke after losing a device. Renaming solves that.

Rename from the profile screen or the

パスキーを管理するにはログインしてください。

management UI. Renaming is owner-only and is recorded in the audit log.

Suspend & Resume a Passkey

A passkey can be suspended instead of deleted. A device that is at the repair shop or left at the office does not need its credential destroyed and re-registered later.

A suspended passkey is refused at login and is not offered to the browser, but it survives and can be resumed later.
Users manage their own passkeys from the profile screen and the パスキーを管理するにはログインしてください。 shortcode. An administrator can suspend anyone’s.
A suspended passkey does not count as “having a passkey”, so even a configuration with password login disabled cannot strand a user with nothing to sign in with.

Embedding on Your Site

The login button and passkey-management UI can be embedded on any page, post, or widget as shortcodes or Gutenberg blocks. Handy for a members’ account page or a dedicated login page.

Shortcodes

Shortcode	Purpose
`ユーザー名またはメールアドレスパスキーとは ? パスキーは、指紋・顔認証や端末のロック解除 (PIN) でログインできる、パスワード不要のしくみです。フィッシングに強く、パスワードの使い回しや漏えいの心配がありません。`	A passkey sign-in button for logged-out visitors. Supports the `redirect` (URL to go to after success) and `label` (button text) attributes.
`パスキーを管理するにはログインしてください。`	A management UI where logged-in users can register, remove, rename, and suspend their own passkeys.

Examples:

		
			
				ユーザー名またはメールアドレス
				
			
			
			
						パスキーとは ?
パスキーは、指紋・顔認証や端末のロック解除 (PIN) でログインできる、パスワード不要のしくみです。フィッシングに強く、パスワードの使い回しや漏えいの心配がありません。
					
		

パスキーを管理するにはログインしてください。

Gutenberg Blocks

In the block editor the same features are available as the “Sign in with a passkey” block and the “Manage passkeys” block. Each block’s sidebar panel lets you set the redirect URL and the button label.

Site-wide Passkey List

Administrators can review every passkey on the site under Users > Passkeys. Answering “who still has a passkey on the laptop we just lost?” no longer means opening user profiles one at a time.

The list is searchable by owner or passkey name and shows:

The owner and authenticator (provider)
When it was registered
When it was last used (or “never”)
Its status (active / suspended)

You can suspend or delete any passkey in place from the list.

Users List Passkey Column

Users > All Users also gains a “Passkey” column showing, per user, how many passkeys they have registered, the last-used time, or that they have none.

Admin Enrolment

An administrator can register a passkey on another user’s behalf — for handing over a pre-configured security key or setting someone up in person.

Off by default. Turn it on under Rapls Passkey Pro > Administrator enrolment, or on sites without Pro, enable it with the rapls_passkey/allow_admin_enrolment filter.
Only administrators with the edit_user capability for that specific user can do it.
The enrolment is emailed to the account’s owner and recorded in the audit log.

2FA Plugin Coexistence

Rapls Passkey works alongside SiteGuard WP Plugin, CloudSecure WP Security, Wordfence (Login Security), and Two-Factor. It is designed to coexist with both login-hardening plugins and two-factor (2FA) plugins.

SiteGuard / CloudSecure WP Security image CAPTCHA: Because Rapls Passkey uses the standard login_form hook, the image CAPTCHA these plugins add to the login screen still applies to the Free password login form. And even when they restrict the REST API to logged-in users, the passkey login route (the rapls-passkey/v1 namespace) is re-opened so passkey sign-in is not blocked. The first-run setup check shows which security plugins were detected and how they coexist.

Wordfence Login Security / Two-Factor and other 2FA:

A passkey counts as the second factor: A passkey sign-in is itself phishing-resistant multi-factor authentication (MFA), so it is never challenged again by a separate 2FA screen (the same applies to the cross-device QR flow and passkey sign-up).
Weaker logins still pass the site’s 2FA: Logins via an email magic link or recovery code (Pro) set the session without going through the password chain, so they used to bypass the site’s 2FA. Those logins now stop at a two-factor challenge screen and complete only after the site’s own 2FA plugin verifies the code (using Wordfence’s own check, for example, rather than a re-implementation).

Note: The extra two-factor challenge only ever appears for users who have actually configured a second factor. RAPLS_PASSKEY_BYPASS lifts this challenge along with the rest of enforcement, so it cannot lock anyone out. Switch it off under Settings > Session security, control it per login with the rapls_passkey/require_second_factor filter, and register adapters for other 2FA plugins with rapls_passkey/second_factor_providers.

reCAPTCHA v3 & Login Rate Limit

reCAPTCHA v3 (Password Login Protection)

Protect the password login form with Google reCAPTCHA v3. It does not apply to passkey logins (brute force does not work against them).

Open the “reCAPTCHA v3” section under Settings > Rapls Passkey.
Enter the site key and secret key from Google reCAPTCHA.
Adjust the score threshold if needed (default 0.5).
Tick “Enable reCAPTCHA” and save.

Security: The secret key you enter is stored encrypted rather than in plaintext (versioned, tagged ciphertext via libsodium, with an OpenSSL AES-256-GCM fallback). Settings export decrypts secrets so a configuration stays portable between sites.

Login Rate Limit

Limits the number of failed login attempts per IP address within a time window. Once the threshold is exceeded, the IP is locked out for the configured window.

Only failed passkey assertions count toward the limit. The /login/options request that the browser legitimately makes several times per page for autofill is not counted.
A successful sign-in clears the counter.
The attempt limit and lockout time are adjustable on the settings screen (default: 30 attempts per 300 seconds). Setting the limit to 0 disables it.
They can also be changed with the rapls_passkey_login_rate_max / rapls_passkey_login_rate_window filters.

Notifications & Audit Log

Rapls Passkey keeps users informed of important actions and records them so administrators can trace what happened.

Security notification emails: Notify the user about passkey registration and removal, and about passkey sign-ins from a new device (can be disabled in settings, and controlled individually with filters).
Audit log: Records registration, removal, rename, suspend, and sign-in events. Export it as CSV from the settings screen (UTF-8 with BOM for Excel; spreadsheet formula injection is neutralized).

Emergency Bypass

As a break-glass measure for when you cannot sign in with a passkey, add the following single line to wp-config.php to temporarily lift passkey enforcement and the two-factor challenge.

define( 'RAPLS_PASSKEY_BYPASS', true );

Caution: This is a temporary emergency measure only. Once you have recovered and can sign in normally (for example with your password), remove the line again. Because password login works alongside passkeys by default, in most cases you can simply sign in with your password and then remove or re-register passkeys from your profile screen.

WP-CLI

Inspect and manage passkeys from the command line. Useful for automating operations and for server-side recovery when someone cannot sign in.

Command	Description
`wp rapls-passkey list --user=<user>`	Lists a user’s registered passkeys (id, label, created date, last used, sign count). `--user` accepts a user id, login, or email.
`wp rapls-passkey remove <id>`	Removes a passkey by its row id (find it with `list`). The removal is recorded in the audit log against the credential’s owner.
`wp rapls-passkey stats`	Shows site-wide adoption totals (total passkeys and the number of users with a passkey).

Examples:

# List the admin user's passkeys
wp rapls-passkey list --user=admin

# Remove passkey with id 12
wp rapls-passkey remove 12

# Show site-wide adoption
wp rapls-passkey stats

Site Health

Rapls Passkey adds self-checks to Tools > Site Health that confirm passkeys can work correctly.

Whether the site is served over HTTPS
Whether the WebAuthn library is loaded
Whether the plugin’s database tables exist
Whether the RP ID and security-plugin coexistence look correct

An Info-tab panel is also added, which you can export when contacting support.

FAQ

Lost Your Passkey

Q: What if I lose my passkey and cannot sign in?

Password login works alongside passkeys, so sign in with your password as usual and then remove or re-register passkeys from your profile screen. You can also manage them from the server with WP-CLI (wp rapls-passkey list / remove). If you still cannot get in, add define( 'RAPLS_PASSKEY_BYPASS', true ); to wp-config.php (and remove it once you have recovered).

Is HTTPS Required

Q: Can I use it on an HTTP site?

No. WebAuthn only works over HTTPS by browser policy. Passkey registration and sign-in are not possible on an HTTP site. The only exception is localhost for development.

Do Passwords Still Work

Q: Do passwords stop working once I add passkeys?

No. In the Free edition, password login stays exactly as it was. Passkeys are an additional option, and users can migrate at their own pace. Disabling password login and enforcing passkeys for a role are Rapls Passkey Pro features.

Using with 2FA

Q: Can I use it with a two-factor plugin?

Yes. It coexists with Wordfence Login Security, Two-Factor, and similar plugins. A passkey sign-in is treated as strong MFA and is not challenged again, while weaker logins such as password still have the site’s 2FA applied to them.

Multiple Devices & Limit

Q: Can one person register multiple passkeys?

Yes. You can register several passkeys — phone, computer, security key — so that losing one device does not lock you out. The per-user registration limit is adjustable on the settings screen.

Security Key Support

Q: Can I use a security key such as a YubiKey?

Yes. In addition to built-in authenticators like Touch ID, Windows Hello, and Face ID, external security keys (roaming authenticators) such as YubiKey are supported. The passkey list shows the authenticator’s provider (iCloud Keychain, Google Password Manager, Windows Hello, 1Password, YubiKey, and more).

Multisite

Q: Is multisite supported?

Yes. Use the rapls_passkey_rp_id / rapls_passkey_rp_name filters to set a shared RP ID. More advanced network-wide policy and shared-RP-ID management are Rapls Passkey Pro features.

Upgrade to Pro

The Free edition is a complete passkey solution on its own, but Rapls Passkey Pro enables organization-wide rollout and stricter policy. Pro runs on top of the free Rapls Passkey plugin (0.12.0 or later) with it installed and active.

Added Features PRO

Cross-device QR login: The computer shows a QR plus a 4-digit confirmation code; scan with your phone and approve with your passkey. The code blocks relay phishing, and it works even when the devices are far apart.
Role-based passkey enforcement: Require a passkey for chosen roles with a grace period for a phased rollout. The last administrator, RAPLS_PASSKEY_BYPASS, and recovery codes prevent lockout.
Single-use recovery codes: Break-glass sign-in when a passkey is unavailable.
Email magic-link login and passwordless sign-up (create an account with a passkey alone).
Adaptive step-up: Ask for a passkey again after a risky password login (untrusted device + unknown location), or on every password login.
Withhold application passwords and refuse “Lost your password?” for users meant to be passwordless.
Trusted-device management and a post-login enrolment prompt for users without a passkey.
Authenticator policy: FIDO Metadata Service (MDS) certification checks and AAGUID allow/deny lists.
Security webhooks (Slack / Teams / generic JSON) and adoption reports (digest and reminder emails, analytics).
Multisite network-wide policy and shared RP ID, settings export/import, and extended WP-CLI.