Passkeys for WordPress Admins: The Actual Setup

Passkeys have been available in some form for WordPress for a couple of years. In 2026 they crossed a specific threshold, which is that most serious security guidance now recommends them as the default for admin logins rather than a nice to have alongside TOTP. Core still doesn't ship them, which means you're adding them via plugin, and if you get the setup wrong you'll lock yourself out of the very account you were trying to protect. This post is the specific configuration I'd walk a client through today.

What a passkey actually is

A passkey is a cryptographic key pair stored on a device, usually your phone, your laptop's built in security chip, or a hardware key like a YubiKey. Instead of typing a password, you prove possession of the device. The private key never leaves the device. The site only ever sees a signature over a challenge it just sent you.

Two properties matter for a WordPress admin login. First, passkeys are phishing resistant in a way that even TOTP codes aren't. A convincing fake login page can capture a password and a six digit code and use them in real time. It can't capture a passkey, because the passkey signs a challenge that includes the actual domain it's talking to. A fake domain gets a signature for the fake domain and the real site rejects it. Second, there's no shared secret. Nothing to steal from a database, nothing to leak in a breach.

For an admin account on a WordPress site, that combination is a genuine step up on anything you were doing before. It's better than passwords alone. It's better than passwords plus SMS. And it's meaningfully better than passwords plus a TOTP app, which was the previous best answer.

Why WordPress core still doesn't ship them

Fair question. Core has been moving carefully on authentication for years, and the passkey implementation surface is substantial. It involves WebAuthn browser APIs, careful UX around authenticator registration, backup codes, recovery flows, and a whole category of edge cases around users with multiple devices and users with no device that supports passkeys at all. Getting any of it wrong locks people out of their own sites.

Core will get there. In the meantime the plugin ecosystem has filled the gap and the good options are stable enough to rely on.

What plugin to use

Three defensible choices as of mid 2026.

Secure Passkeys by the WordPress.org core WebAuthn team is the closest thing to a core implementation. Free, actively maintained, focused specifically on passkeys with no additional features. If you want the plugin that will most cleanly transition into eventual core support, this is it. Recommended for most sites.

Solid Security (formerly iThemes Security) includes passkey support in its free tier as of the 2025 rebuild. Worth considering if you want a broader security plugin and passkeys as one feature among several, rather than a single purpose plugin.

WP 2FA by Melapress added passkey support in 2025. Good option if you're already using it for TOTP and want to move users onto passkeys gradually.

I'd default to Secure Passkeys for a new setup unless you have a specific reason to prefer one of the others. It does one thing, it does it well, and the codebase is small enough to reason about.

The setup that won't lock you out

This is the part that matters most, because a badly configured passkey rollout is worse than no passkey rollout. If you get locked out of your admin account with no fallback, your day is ruined. Follow this order and you'll be fine.

Have a fallback password ready - Don't disable password login when you turn on passkeys. Not yet. The passkey becomes your primary authentication method, but the password remains as an emergency fallback until you've proved to yourself that the passkey flow works reliably across every device and browser you actually use to log in.
Register multiple authenticators - Do not register just your laptop's built in passkey and stop. Register at least three. The realistic combination for most admins looks like: laptop built in (Touch ID or Windows Hello), phone (iCloud Keychain or Google Password Manager), and a hardware key stored somewhere safe as a break glass option. If any one device fails, gets lost, or gets replaced, you have others.
Store backup codes if the plugin offers them - Not all passkey plugins do, and the ones that do handle it differently. If yours does, generate the codes, print them, put them somewhere physical. Treat them like the recovery codes on a bank login.
Test the recovery flow before you need it - Log out. Log back in with the passkey. Log out. Log back in with a different registered device. Log out. Actually try the account recovery flow with the fallback password. Do all of this while you still have easy access to the site. Not in a panic after you've dropped your phone in the sea.
Only then, consider disabling password login - Some sites will want to. Most sites shouldn't yet. The current best practice is passwordless optional: passkeys as the primary flow, passwords as a fallback that's protected by a strong password, ideally rotated periodically, and definitely not shared with any other account you use.

What passkeys can't do

Two limitations worth stating clearly.

They don't secure the WordPress admin API - Your admin login is now phishing resistant, which is a real gain. Your XML-RPC endpoint, your REST API, your application passwords for programmatic access, your wp-login.php brute force surface for other users on the site: none of those have anything to do with passkeys and all of them still need the hardening they've always needed. Passkeys secure the human login flow. Everything else on the site is unchanged.
They don't replace 2FA policy for team sites - On a site with multiple admins, moving one account to passkeys doesn't secure the rest. The threat model is the weakest link in the admin user list. If you're rolling passkeys out on a site with several admin accounts, roll them out to all of them, and don't leave a single "we'll get to it later" admin still on password plus SMS. That's the account that gets phished.

The setup checklist

Ten minutes of work if the plugin behaves. Do all ten.

Install Secure Passkeys (or your chosen alternative).
Configure passkeys for your own admin account.
Register your laptop as an authenticator.
Register your phone as an authenticator.
Register a hardware key as an authenticator, if you have one. Order one if you don't.
Log out and log back in with each.
Confirm the fallback password still works.
Print backup codes if the plugin provides them.
Repeat for every other admin account on the site.
Diary a reminder to review the registered authenticators every six months.

That's it. You now have the strongest available authentication on your WordPress admin login, and you have not painted yourself into a corner.

Where this fits

The Protect My WP handbook covers WordPress authentication in Chapter 3, including the wider set of login hardening measures that make sense to run alongside a passkey rollout: login URL changes, attempt limiting, session management, application passwords, and the specific configuration for XML-RPC and REST API access that passkeys don't touch. Passkeys are a genuine upgrade for the admin login. They work best as part of a wider approach.

If you're setting up passkeys and want the full picture, the book is where it lives.

Get the book for £19.