WordPress core still doesn’t ship passkey login out of the box. If you want it, you need a plugin, and the specific plugin you pick matters more than it looks like on the surface.
Here’s a fact worth knowing before you install anything: the WordPress core team’s own recommended 2FA plugin, called simply “Two Factor,” actually removed its hardware security key support in version 0.16.0, released on March 27, 2026. The reason is legitimate, older browsers stopped supporting the legacy FIDO U2F standard it relied on, so the maintainers pulled it rather than ship something broken. But the practical result is real: if you want modern passkey or hardware-key login on that plugin today, you need to separately install a second plugin (a companion called “Two-Factor Provider: WebAuthn”) just to get back what used to work in one.
That’s not a criticism of the Two Factor plugin’s team, who made a sensible call given the constraint they were working with. It’s just useful to know going in: “free WordPress 2FA plugin” and “free WordPress 2FA plugin with working passkeys, in one install” aren’t always the same search.
Why This Actually Matters When You’re Choosing
Needing two plugins instead of one isn’t just an inconvenience. Every additional plugin is another thing that can conflict with your theme, another thing to keep updated, another maintainer whose priorities might shift, and another point where things can quietly break during a WordPress core update. None of that is a reason to avoid the Two Factor plugin outright, it’s genuinely well built and actively maintained by people who ship WordPress core itself. It’s a reason to know what you’re actually getting before you commit to a setup.
What “Free” Actually Means Across the Options
The WordPress 2FA plugin space splits roughly three ways:
Genuinely free, capability-limited. Some free tiers are usable but deliberately cap what you can do, a limited number of users, no enforcement policies, or passkeys held back for a paid tier entirely.
Free, but needs a second plugin for passkeys. The Two Factor situation above. Solid core functionality, modern hardware-key support requires an extra install.
Free, with passkeys included in the same plugin. Less common than either of the above, genuinely rare in this specific category.
None of these are wrong choices exactly, they solve real problems for real people. But “free” is doing different amounts of work in each case, and it’s worth knowing which one you’re actually looking at.
What to Actually Check Before Installing
A few concrete things worth confirming before you commit to a 2FA plugin, regardless of which one:
- Does passkey support ship in the main plugin, or require a second install? Both are fine, but only one is a single dependency to keep updated.
- Is there a genuine backup method if someone loses their device? One-time backup codes, generated and shown once, are the standard. If a plugin doesn’t offer this, losing a phone means losing access.
- Can you require 2FA for specific roles, or is it purely opt-in? For a single-owner site this barely matters. For a site with multiple admins or editors, opt-in-only 2FA usually means most people never turn it on.
- What happens if you get locked out? A plugin with no documented recovery path is a real risk, not a theoretical one.
Where SecondGate Fits
SecondGate includes passkeys (Face ID, Touch ID, Windows Hello, hardware keys) in the same free plugin as TOTP, brute-force protection, and everything else, no second install required to get modern login security working. Backup codes are generated automatically and shown once at setup. Two-factor enforcement can be turned on per role if you’re managing more than one account.
It’s not a replacement for the Two Factor plugin’s philosophy, being small, developer-maintained, and unopinionated is a genuinely reasonable choice for some sites. It’s simply a different answer to the same question: what does “free 2FA plugin” actually include, in one install, without a follow-up trip to find the piece that’s missing.
Sources: WordPress.org’s official Two Factor plugin changelog, confirming FIDO U2F removal in version 0.16.0.
