Linux 软件免费装

在这里免费安装WordPress以及其他软件

Banner图

Advanced Passkeys for Secure Login

开发者 wppasskey
mbuiux
更新时间 2026年7月9日 06:58
PHP版本: 8.0 及以上
WordPress版本: 7.0
版权: GPLv2 or later
版权网址: 版权信息

标签

security login passwordless webauthn passkeys

下载

1.1.11 1.1.7 1.1.8 1.1.9 1.1.10 1.1.5 1.1.6

详情介绍:

Passwords are the single biggest security liability for your WordPress site. They get leaked, reused, and exploited by automated brute-force attacks every single day. While standard Two-Factor Authentication (2FA) adds a layer of safety, typing in temporary codes from SMS or authenticator apps introduces annoying workflow friction that hurts user adoption and slows down your day. Advanced Passkeys for Secure Login brings the future of un-phishable, lightning-fast authentication directly to WordPress using the official FIDO2 / WebAuthn standard. Give your users a modern login experience. Users register a secure passkey just once using their device's built-in biometric sensor (Face ID, Touch ID, Windows Hello), device PIN, or a hardware security key (like a YubiKey). Future sign-ins can bypass traditional password fields and reduce credential-theft risk.

安装:

Automatic installation
  1. In your WordPress dashboard, navigate to Plugins > Add New.
  2. Search for Advanced Passkeys for Secure Login.
  3. Click Install Now and then click Activate.
  4. Navigate to Settings > Advanced Passkeys to fine-tune your security configuration.
Manual installation
  1. Download the plugin ZIP archive file from WordPress.org.
  2. In your dashboard, go to Plugins > Add New > Upload Plugin and choose the downloaded file.
  3. Click Activate.
  4. Navigate to Settings > Advanced Passkeys to get started.
Quick Start Onboarding Guide
  1. Head to Settings > Advanced Passkeys — confirm passkeys are enabled and review your allowed user roles.
  2. Navigate directly to Users > Your Profile and register your first passkey.
  3. Sign out of your dashboard to confirm the secure Sign in with Passkey button appears below the password form.
  4. Pro Tip: Register a secondary backup passkey (such as a mobile device or physical hardware key) to ensure you have a fallback access path.
Local Development & Staging Environments The official WebAuthn protocol strictly mandates a secure connection context (HTTPS) in production. To protect your site, the plugin blocks live passkey validation over unsecured HTTP web connections. If you are a developer testing locally on a development server environment without a local SSL certificate installed, you can easily bypass this security restriction by defining this helper flag inside your local wp-config.php file: define( 'ADVAPAFO_ALLOW_HTTP', true ); (Warning: Never define this configuration constant on a live production environment!)

屏幕截图:

  • The core configuration settings view showing role management selections, biometric behaviors, and integrated platform switches.
  • The advanced developer configuration panel exposing parameters for WebAuthn RP IDs, token lifetimes, and security connection locks.
  • The helper copy dashboard offering copy-ready Gutenberg module paths and complete shortcode templates for clean site layout assembly.
  • The frontend User Profile responsive administration panel where site users manage, name, and revoke credentials.
  • The standard core WordPress login layout showing the passkey sign-in button below the password form.
  • The returning user login state demonstrating the Last used device indicator pill for returning passkey users.

升级注意事项:

1.1.11 Recommended update: improves passkey login guidance, refreshes the sign-in button icon, and fixes admin toggle rendering.

常见问题:

Does this replace standard WordPress passwords entirely?

No. Passkeys function as a high-security alternative login method. Users retain their standard WordPress password as a fallback authentication method if their passkey device is missing or unavailable.

Does this plugin require an active SSL Certificate (HTTPS)?

Yes, in live production environments. Secure biometric authentication requires an encrypted HTTPS context to communicate safely with authenticators. To preview features locally via standard HTTP, please refer to the local development instructions outlined in the Installation section.

Can developers manage passkey policies directly in code?

Yes, seamlessly. Agency teams and developers can manage the plugin's complete option array using the centralized advapafo_local_configuration filter or the global ADVAPAFO_SETTINGS PHP array constant. Setting your policy in code locks the matching WordPress admin dashboard control, displaying a clear Managed via code status flag to prevent configuration drift.

Which major browsers, platforms, and biometric devices are supported?

Any operating system and browser that supports modern WebAuthn standards (supported by all primary vendors since 2022). This covers Apple Safari, Google Chrome, Mozilla Firefox, and Microsoft Edge across macOS, iOS, Windows Hello biometrics, Android fingerprint scanners, and physical FIDO2/U2F keys like YubiKeys.

Can I restrict passkey creation to specific user roles?

Yes. Navigate to Settings > Advanced Passkeys > Eligible Roles to limit access. The plugin defaults to Administrators only, and you can enable passkey access for Subscribers, Customers, or custom membership roles as needed.

Which dynamic shortcodes are packaged with the plugin?

Global Core Shortcodes:

  • [advapafo_login_button] — Renders the standalone passkey login button.
  • [advapafo_register_button] — Places a passkey enrollment trigger on any frontend layout.
  • [advapafo_passkey_profile] — Displays a full credential management table for logged-in profiles.
  • [advapafo_passkey_prompt] — Embeds an interactive onboarding registration area. Ecosystem Integration Shortcodes: (Automatically responsive when companion plugins are active)
  • [advapafo_woocommerce_login]
  • [advapafo_edd_login]
  • [advapafo_memberpress_login]
  • [advapafo_ultimate_member_login]
  • [advapafo_learndash_login]
  • [advapafo_buddyboss_login]
  • [advapafo_gravityforms_login]
  • [advapafo_pmp_login]

Which integrated Gutenberg Blocks are available?

When an ecosystem dependency is active on your site, the plugin registers optimized, native core editor blocks:

  • advanced-passkey-login/woocommerce-login-card
  • advanced-passkey-login/edd-login-card
  • advanced-passkey-login/memberpress-login-card
  • advanced-passkey-login/ultimate-member-login-card
  • advanced-passkey-login/learndash-login-card
  • advanced-passkey-login/buddyboss-login-card
  • advanced-passkey-login/gravityforms-login-card
  • advanced-passkey-login/pmp-login-card

What system PHP extensions must be active on my server hosting?

The plugin runs on standard, lightweight modern server components requiring the openssl, mbstring, and json extensions. These packages are pre-compiled and running out of the box on nearly all managed WordPress web hosts.

Is the plugin fully WordPress Multisite network compatible?

Yes. Database tables partition dynamically across your network using $wpdb->prefix. Network activation provisions the plugin tables for existing sites and newly created network sites.

Can I use a custom Relying Party ID (RP ID) for complex subdomain setups?

Yes. For compatible subdomain setups, declare your root domain within your site's wp-config.php file: define( 'ADVAPAFO_RP_ID', 'yourdomain.com' );

Can I override the passkey login button HTML templates in my theme files?

Yes. Copy the plugin's internal markup template directly into your theme's active folder structure: /wp-content/themes/your-active-theme/advanced-passkeys/login/button.php

What happens to my database data if I delete the plugin?

Deactivating the plugin preserves passkey records and settings. Running the default WordPress delete routine removes the plugin's credential, rate-limit, and log tables alongside matching advapafo_* configuration rows.

更新日志:

1.1.11 1.1.10 1.1.9 1.1.8 1.1.7 1.1.6 1.1.5 1.1.4 1.1.2 1.1.1 1.1.0 1.0.0