Passwordless X1280
| 开发者 | passwordlessalliance |
|---|---|
| 更新时间 | 2026年7月28日 12:25 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- Built on the ITU-T X.1280 international standard – a globally recognized passwordless authentication framework designed for the zero-trust era.
- Mutual authentication – users verify the service before authenticating, helping prevent phishing and fraudulent login pages.
- Smartphone-based biometrics – authenticate securely with Face ID or fingerprint recognition, even when the computer itself has no biometric hardware (out-of-band authentication).
- No additional hardware required – works with existing smartphones and browsers; no security keys or dedicated sensors to buy.
- Free for B2C online services – provided by the non-profit Passwordless Alliance to promote safer digital services worldwide.
- The WordPress login page displays a unique auto-password.
- The user checks that the same auto-password appears in the Passwordless X1280 mobile app.
- After confirming the service identity, the user approves the login with smartphone biometrics.
- Authentication completes securely — no password is typed or transmitted.
- Adds a Password / Passwordless login option to
wp-login.php - Secure WebAuthn / passkey-based authentication
- Admin settings panel for X1280 server configuration
- Option to disable password-based login entirely
- Uses WordPress hooks only — no core file modifications
- Compatible with multisite environments
- Works alongside caching and security plugins
- Passwordless X1280 Login Page – displays the passwordless login interface using the
[px1280_login]shortcode - Passwordless X1280 Register / Unregister Page – lets users register and manage passkeys using the
[px1280_manage]shortcode
- No passwords are transmitted during passwordless authentication
- Out-of-band approval on a separate trusted device (the user's smartphone)
- Uses WordPress nonces and secure server-side verification
- Requires HTTPS (a WebAuthn requirement)
- Does not modify WordPress core files
- A WordPress site served over HTTPS
- Users need a smartphone with the free Passwordless X1280 mobile app (App Store / Google Play)
- A Server Key for the X1280 Authentication Server (see the FAQ for how to obtain one)
- Service name: X1280 Authentication Server
- Service URL: http://wp-x1280.dualauth.com
- Service provider: Passwordless Alliance
- Username (userId)
- Authentication session data (token, random, sessionId)
- Server key (for verification)
- Authentication result (approved / denied)
- Service password (OTP)
- Push notification data
- During login (passwordless authentication)
- During registration / unregistration of passkeys
安装:
- Upload the
passwordless-x1280folder to the/wp-content/plugins/directory, or install the plugin through the WordPress plugins screen directly. - Activate the plugin through the Plugins menu in WordPress.
- Go to Dashboard → Passwordless X1280 and configure the following: Server Key (provided by X1280), Authentication Server Domain (port 11040), Push Server Domain (port 15010), and, optionally, disable password-based login.
- Ask your users to install the Passwordless X1280 mobile app and register their account on the automatically created Register / Unregister page.
- Log in through
wp-login.phpor the generated login page using the Passwordless option.
常见问题:
Is Passwordless X1280 free?
Yes. Passwordless X1280 is provided free of charge by the non-profit Passwordless Alliance for B2C (consumer-facing) online services worldwide. It is not licensed for internal systems whose users are employees, contractors, or agents of the operating organization. The companion mobile app is free for users and ad-supported, which is how the Alliance funds free distribution.
What do my users need?
A smartphone with the free Passwordless X1280 mobile app installed (App Store / Google Play). Biometric verification uses the phone's own Face ID or fingerprint sensor, so no extra hardware is needed on PCs or other devices. A single app can manage passwordless login for multiple online services.
Where do I get a Server Key?
Register (free of charge) as a Service Member of the Passwordless Alliance and submit a passwordless service application; a license key is issued after verification. For testing purposes, select "testing" as the purpose of use when applying and a key is issued automatically, although domain linking is not supported for test keys. See Become a member for details. The X1280 server application itself is distributed via Docker Hub.
Does my site need HTTPS?
Yes. WebAuthn only works on sites served over HTTPS, so a valid SSL/TLS certificate is required.
Can users still log in with a password?
Yes. By default, the standard password login remains available alongside the passwordless option on wp-login.php. Administrators can disable password-based login from the plugin settings if they want passwordless-only authentication.
What if a user loses or replaces their phone?
If password login is enabled, the user can regain access through WordPress's standard password recovery, then unregister the old device and register the new smartphone on the Register / Unregister page ([px1280_manage]).
Does the plugin modify WordPress core files?
No. It uses standard WordPress hooks only, and it is compatible with multisite environments as well as common caching and security plugins.
更新日志:
- Initial release
- Passwordless login integration
- Admin configuration panel
- Automatic page creation
- Password login restriction option
- Shortcode support