Passkeys are having a real moment in WordPress in 2026, and for good reason. Built on the FIDO2/WebAuthn standard developed by the FIDO Alliance and W3C, a passkey is a cryptographic key pair, the private half never leaves the user’s device, the public half is the only thing your site ever stores. There’s no shared secret to phish, no password to leak in a breach, no reset email to intercept.
Most of what’s available for WordPress right now is a dedicated, single-purpose passkey plugin, install it, and it adds passwordless login on top of whatever else you’re already running. That’s a reasonable approach, and worth understanding what to actually check before picking one, whether that’s a standalone plugin or, like SecondGate, passkeys built into a broader security plugin from the start.
What a passkey login actually proves, and what it doesn’t
A passkey proves possession, whoever’s logging in holds the registered device (or has passed its biometric or PIN check to unlock the key). It’s phishing-resistant in a specific, structural way a password never can be: the credential is cryptographically bound to your site’s exact domain, so even a pixel-perfect fake login page can’t capture anything reusable, there’s nothing to type that a phishing page could steal.
What it doesn’t prove is that the same person is still at the keyboard five minutes later. That’s a genuinely different problem, and one worth checking whether a plugin addresses at all, most don’t, since it falls outside what WebAuthn itself is designed to answer.
What to actually check in a passkey plugin
A few things matter more than the marketing copy:
- Is it built from a real WebAuthn library or hand-rolled? Most dedicated plugins wrap an existing PHP WebAuthn library, which is a completely reasonable choice, mature libraries exist and are well-tested. Worth knowing either way, since it tells you whether you’re trusting a maintained third-party dependency or the plugin author’s own implementation.
- Does it touch anything else on the page? One real complaint that’s come up with at least one popular passkey plugin: it injects its own Content-Security-Policy header, which can silently clobber a site’s existing CSP if one’s already configured. Worth testing on staging specifically for this before rolling out to a live site.
- Does old-style login still work as a fallback? Most plugins leave password login active unless you explicitly disable it, which is the right default, passkey adoption is gradual and user-driven, not everyone will register one on day one.
- Does it pair with your existing 2FA setup, or replace it? Some passkey plugins are explicitly designed to work alongside a separate 2FA plugin (WordPress core’s own Two Factor plugin, for instance, needs a companion WebAuthn provider plugin for passkey support at all). Worth knowing which model you’re getting into before you’re running three login-related plugins that all need to keep working together after every WordPress update.
How SecondGate implements it
SecondGate builds WebAuthn in directly rather than as an add-on, no companion plugin, no third-party library, no Composer dependency. Challenge verification, origin binding, relying-party ID hash confirmation, and signature verification (openssl_verify(), PHP’s own crypto extension, not homemade math) all run against the raw binary attestation and assertion data, including a custom CBOR decoder built specifically for the narrow subset of CBOR that WebAuthn’s attestation objects actually use, not a general-purpose parser pressed into service.
That decoder has actually been checked, not just written and shipped:
- Run against the official RFC 8949 Appendix A conformance vectors, every well-formed CBOR construct in scope decoded correctly.
- Fed a genuine attestation and assertion captured from a real MacOS TouchID authenticator (public fixtures from the widely-used
duo-labs/webauthnlibrary), with every extracted value, credential ID, signature counter, public key, matching exactly through the full parsing path. - Run through 200,000 mutation-fuzzed inputs built from those same real seeds, specifically hunting for anything that would slip past the codebase’s own exception handling and become an uncaught fatal error instead of failing cleanly.
That fuzzing found one real bug (a CBOR map with a non-scalar key threw an uncaught error), and hand-crafted adversarial cases found three more (truncated strings and integers that previously decoded silently to a wrong value instead of throwing; trailing bytes after a complete structure that weren’t being rejected). All four were fixed. None of them, in testing, ever let anything through the actual cryptographic checks, no forged signature, no forged credential, no bypassed challenge or origin check, they were parsing-layer bugs, not authentication bypasses, and worth being precise about that distinction rather than overstating it.
The part after login most plugins don’t cover
A passkey answers “does this device belong to the account owner.” It doesn’t answer “is the session still being used by that same person.” This is a Pro-tier layer on SecondGate (£39.99/year), not part of the free passkey implementation: a session guard that runs after a successful login, watching for characteristics of a hijacked session, with an option to force logout if one’s detected, plus a lighter, deliberately uncertain signal underneath the passkey itself, comparing mouse movement and time-on-screen during a passkey login (there’s nothing to type, so no keystroke rhythm to compare) against that account’s own established pattern from past logins. It’s treated as exactly what it is, a weak, noisy signal that only ever contributes to a broader threat score, never a standalone block, and it doesn’t start comparing until an account has at least five past logins to build a real baseline against.
Where a dedicated passkey plugin might still be the better fit
Worth saying plainly: if all you want is passkey login bolted onto an otherwise-unprotected site, and nothing else, a lightweight single-purpose plugin does exactly that one job and nothing more, which is a legitimate reason to prefer one. SecondGate’s passkey implementation is free and comes as part of a broader plugin, whose deeper layer (file integrity scanning, threat scoring, session hijacking detection) sits on a paid Pro tier rather than being bundled in for free, either that’s exactly what you want or more than you need, depending on what else you’re already running.
