ThreeWay Login

ThreeWay Login replaces the first view of the standard WordPress login screen with three clear choices:

• Continue with a passkey using Face ID, a fingerprint, or the device screen lock
• Receive a one-time 6-digit code by email
• Use the classic WordPress password form

Before a passkey is configured, administrators can choose whether email code login or the classic username-and-password form is shown first. After a passkey is created, the same browser shows passkey login as the primary choice. The passkey preference is stored only in that browser. The classic WordPress login remains available at all times. Passkeys use the WebAuthn standard and create phishing-resistant credentials tied to the website. Private passkey keys remain in the user's device or passkey provider. Only the public credential is stored in WordPress. Email codes expire after 10 minutes, can be used once, and allow no more than five verification attempts. The plugin uses neutral responses and request limits to reduce account discovery and automated abuse. The plugin does not create accounts. Every login method works only for an existing WordPress user. Passkey management Signed-in users can add and remove passkeys from their WordPress profile. Sites with a custom account area can place the [threeway_login_passkeys] shortcode on a protected page. After each new login, users without a passkey can see the setup invitation once. They can create a passkey, close the invitation for that login, or choose not to see it again. It is not shown when the user already has a passkey or has permanently dismissed the invitation. Settings Open Settings → ThreeWay Login to choose the default method for browsers without a passkey and to customize the login email subject, introductory text, accent color, and passkey invitation. Requirements Passkeys require HTTPS and a browser with WebAuthn support. Local development on localhost is also supported. Email codes are sent through the standard WordPress wp_mail() function. Reliable delivery depends on the website's email configuration. A properly configured transactional email or SMTP service is recommended.

1. Upload the plugin ZIP through Plugins → Add New Plugin → Upload Plugin.
2. Activate ThreeWay Login.
3. Optionally open Settings → ThreeWay Login to customize the login email.
4. Open the standard WordPress login page to see the new login choices.
5. Sign in and open your profile to add a passkey.

No configuration is required.

1.0.4

• Renamed the plugin to ThreeWay Login with the distinctive threeway-login slug.
• Removed bundled translation files in favor of translate.wordpress.org.
• Removed inline login CSS and retained the standard WordPress form when JavaScript is unavailable.

1.0.3

• Added a setting to choose email code or username and password as the default when no passkey is configured.
• Show the passkey setup invitation only once after each new login, with separate options to postpone or permanently dismiss it.
• Aligned the plugin folder, main file, REST namespace, and text domain with the WordPress.org slug.
• Completed uninstall cleanup and reduced temporary database writes for rejected code requests.

1.0.2

• Added consistent spacing above and below explanatory text on the login screens.

1.0.1

• Fixed the external “Use another login method” switch.
• Removed the redundant Back link from the email form.
• Fixed hidden controls and the misplaced “or” separator.
• Added spacing below explanatory text.

1.0.0

• Renamed the plugin during initial development.
• Added a settings page under Settings.
• Added a clean HTML email with a prominent login code.
• Added customizable email subject, introduction, and accent color.
• Clarified the email-code flow while retaining account-enumeration protection.
• Fixed the link back from classic password login.

0.2.0

• Show email code login by default until a passkey has been configured.
• Show passkey login as the primary choice after successful setup in that browser.
• Added a one-time, dismissible passkey setup prompt after login.
• Hide the passkey option when it is unsupported or not yet configured.
• Keep password login available as a backup.

0.1.0

• Initial testing release.
• Added passkey login and passkey management.
• Added 6-digit one-time email codes.
• Kept the classic WordPress password login available.
• Added browser-local memory of the last selected login method.