WordPress Passkey and 2FA Plugin

Nothing to type, nothing to steal, just your device saying yes.

Passwords aren’t the only weak point in a login. A brute-force script hammering the login page, a stolen session cookie, a device nobody recognises signing in at 3am, each one gets caught by something specific, not a single generic “monitoring” feature that hopes to notice. Standard authenticator codes, automatic lockouts, role-based enforcement, alerts on anything unfamiliar, and continuous checks on sessions already open, together, not as an afterthought.

Key Features

Standard Authenticator Support

Not everyone wants a passkey, and that's fine, TOTP works exactly as well. Any standard authenticator app, Google Authenticator, Authy, 1Password, or whatever's already on your phone, generates codes checked entirely on your own server. No third-party service ever sees the code, no external account required, and it's free forever alongside passkeys, not a fallback tier for people who couldn't get the better option working.

Automatic Lockout

Someone guessing passwords against your login page gets shut out automatically, by IP address and by the specific username being targeted, before they get anywhere near enough attempts to succeed. Genuine account owners are never caught in it, a real login always goes through, this only ever slows down the exact pattern of repeated wrong attempts a script produces.

Role-Based Enforcement

Turning on required 2FA doesn't mean everyone gets locked out the second it's switched on. Set it by role, administrators only, editors and above, or the whole site, and every account gets a configurable grace period to set theirs up before it's actually enforced. Nobody finds out they're locked out mid-task.

New-Device Alerts

The first time an account signs in from a device that's never been seen before, that login gets flagged and a step-up check runs before access is granted, not after. You get told immediately, not the next time you happen to check.

Session Hijacking Detection

A stolen session cookie doesn't need a new login to work, which is exactly why login-time checks alone can't catch it. This monitors sessions that are already open, continuously, watching for the kind of sudden change in behaviour a hijacked session produces, not just the moment someone signs in.

New-Country Alerts

The same alert fires for a login from a country the account has never signed in from, even on a device that's technically been seen before. A device being familiar and a location being familiar are two different signals, and this checks both.

Passkeys and 2FA, free forever, no catch

Get free access Get free access Get free access

Login Security & Two-Factor Authentication

Every claim checked against a real site