Passwords are the single biggest security liability for your WordPress site. They get leaked, reused, and exploited by automated brute-force attacks every single day. While standard Two-Factor Authentication (2FA) adds a layer of safety, typing in temporary codes from SMS or authenticator apps introduces annoying workflow friction that hurts user adoption and slows down your day.

Advanced Passkeys for Secure Login brings the future of un-phishable, lightning-fast authentication directly to WordPress using the official FIDO2 / WebAuthn standard.

Give your users a modern login experience. Users register a secure passkey just once using their device’s built-in biometric sensor (Face ID, Touch ID, Windows Hello), device PIN, or a hardware security key (like a YubiKey). Future sign-ins can bypass traditional password fields and reduce credential-theft risk.

Out-of-the-Box WooCommerce & Membership Integrations

Don’t settle for basic alternatives that only support the default backend login page. Advanced Passkeys features intelligent, dependency-aware integration modules that automatically inject secure passkey entry points into your existing platform ecosystem. Experience seamless, zero-configuration support for:
* WooCommerce (Secure checkout & customer account login)
* MemberPress & Paid Memberships Pro (PMPro) (Frictionless member portal protection)
* LearnDash (Instant student sign-in to prevent account sharing)
* Ultimate Member & BuddyBoss (Biometric profiles for modern communities)
* Gravity Forms (Protected frontend user-registration flows)

Why Smart Site Owners Choose Passkeys

Strong Phishing Resistance: Passkeys are cryptographically bound to your specific domain name. A fake login page or copycat site cannot reuse a passkey issued for your real site.
Reduce Brute-Force Risk: Passkey login does not rely on a static password being typed into the login form, reducing exposure to automated password-guessing attacks.
Painless Cross-Device Sync: Works natively with iCloud Keychain, Google Password Manager, and 1Password for reliable, frictionless cross-device access across desktop, mobile, and tablet.

Features

One-Click Passwordless Authentication: Adds a native, highly visible “Sign in with Passkey” button directly to your core WordPress login screens.
Conditional UI Autofill Support: Offers optional browser-native passkey autofill prompts when a user focuses on the username field for an incredibly polished user experience.
Ecosystem-Aware Gutenberg Blocks & Shortcodes: Automatically registers matching frontend login cards and components specifically tailored to your active third-party plugins.
High-Yield Admin Nudge Notices: Turn on built-in dashboard reminders that gently guide eligible users to secure their accounts with a passkey without administrator intervention.
Granular Role-Based Security Policies: Configure exactly which user roles are permitted to use biometric authentication (Default: Administrators-only out of the box).
Developer-Managed Overrides: Manage passkey settings in PHP using the centralized advapafo_local_configuration filter or the ADVAPAFO_SETTINGS constant.
Theme Template Customization: Seamlessly match your active brand by overriding the login button template layout via /advanced-passkeys/login/button.php inside your child theme.
Advanced Analytics Dashboard: Track credential performance over time with a live Authenticator Overview breakdown card and a Last Login audit trail log.
Hardened Brute-Force Rate Limiting: Enforce strict local connection limits to log and block malicious behavior, backed by automated daily cleanup crons to keep your database lean.
Multisite Network Provisioning: Network-aware architecture instantly partitions tables dynamically and inherits security guardrails across newly deployed network sites.
Clean Housekeeping Routine: Implements a strict, responsible uninstall function that leaves behind absolutely zero orphaned database tables or leftover configuration choices.

Developer Configuration

Advanced Passkeys supports code-managed configuration for developers, agencies, and infrastructure teams that deploy settings through version control. This helps apply the same passkey policy across many sites without manual option changes.

Configuration evaluation priority order

When resolving a configuration key, the plugin respects this strict top-down hierarchy:

Centralized advapafo_local_configuration hook filter
Global ADVAPAFO_SETTINGS array constant definition
Site-level advapafo_settings option array map
Single historical legacy advapafo_* options
Core plugin out-of-the-box system defaults

Values resolve individually by index key. Overriding a key like login_challenge_ttl via code leaves your remaining settings completely manageable via the dashboard UI or database choices.

Example: Enforce HTTPS and restrict passkey enrollment to administrators

Drop this configuration array inside your active theme’s functions file or a custom functionality plugin:

<?php
add_filter(
    'advapafo_local_configuration',
    static function ( array $configuration ): array {
        return array_replace(
            $configuration,
            array(
                'enforce_https'  => true,
                'eligible_roles' => array( 'administrator' ),
            )
        );
    }
);

Example: Global array constant configuration within wp-config.php

For automated environments that favor infrastructure-level array maps, define this constant:

define(
    'ADVAPAFO_SETTINGS',
    array(
        'conditional_ui_enabled'     => true,
        'login_challenge_ttl'        => 300,
        'registration_challenge_ttl' => 300,
        'max_passkeys_per_user'      => 0,
    )
);