A passkey is a cryptographic key pair built on the WebAuthn standard, developed jointly by the W3C and the FIDO Alliance, the private half never leaves your device, the public half is the only thing WordPress ever stores. Because the credential is bound to your site’s exact domain, it can’t be phished the way a typed password or code can, even a convincing fake login page gets nothing usable. This walks through actually setting one up.
Check plugin support first
WordPress doesn’t include passkey support natively. Some plugins bundle it directly, SecondGate’s free tier includes it with no separate install needed. WordPress.org’s own Two Factor plugin needs a separate companion, Two-Factor Provider: WebAuthn, installed alongside it for passkey support specifically. Confirm which situation you’re in before starting, since the setup path differs slightly.
Step 1: enable the feature in your plugin’s settings
If you’re using a plugin with built-in passkey support, look for a “Passkeys” or “WebAuthn” section in the security settings, usually a single toggle to turn the feature on site-wide before individual users can register their own.
Step 2: register your first passkey
Go to your user profile settings and look for a “Register Passkey” or “Add Passkey” option. Your browser will prompt you to use your device’s built-in authenticator, Face ID or Touch ID on Apple devices, Windows Hello on a PC, or a fingerprint sensor on Android, to confirm it’s really you before creating the credential. Once registered, that specific device becomes a valid login method going forward.
Step 3: register a second device as a backup
Register a passkey on at least one additional device, a second phone, a laptop, or a hardware security key if you have one. A single passkey tied to one device is a real risk if that device is lost, stolen, or replaced, having a genuine backup method matters here the same way it does for any authentication method.
Step 4: keep a fallback method available
Don’t disable password login entirely right after setting up your first passkey. Passkey adoption is gradual, browser and device support has improved significantly but isn’t universal across every combination of device, browser, and operating system version, and a fallback (a strong password plus an authenticator app) means you’re never fully locked out if a passkey login unexpectedly doesn’t work on a particular device.
Step 5: test it properly before relying on it
Log out completely and log back in using only the passkey, on the actual device you registered it on, to confirm the full flow works end to end rather than assuming it does because the registration step completed without error. If you registered a passkey on a phone specifically for logging in from that phone, test that exact scenario, not just a desktop browser where you might still be relying on a saved password without realizing it.
Common issues and what they usually mean
If the passkey prompt never appears at all, check that your site is served over HTTPS, WebAuthn requires a secure connection and simply won’t function over plain HTTP. If a specific browser doesn’t offer the option, check that browser’s own current WebAuthn support, coverage varies slightly between browsers and versions, and an older browser version is a common, overlooked cause. If a registered passkey stops working after switching phones or reinstalling a browser profile, that’s often expected behavior, passkeys are frequently tied to a specific device’s secure hardware, which is precisely why a genuine backup method (step 3 above) matters rather than being optional caution.
Where this fits into a broader security setup
A passkey is a strong login method, but it only protects the login itself. For the complete picture, how to secure a WordPress site covers the rest of what actually closes off real-world compromise routes, and if you’re setting up passkeys as part of a wider 2FA rollout, how to enable two-factor authentication walks through choosing and enforcing a method across a whole team, not just your own account.
