/ Plugin Category

/ User Management & Authentication

/ Security Scanning & Malware Protection

/ WebAuthn Provider for Two Factor

WebAuthn Provider for Two Factor

By Volodymyr Kolesnykov

User Management & Authentication / Security Scanning & Malware Protection

WebAuthn Provider for Two Factor Review - In-Depth Analysis

WebAuthn authentication provider for Two Factor plugin. It enhances security with modern authentication methods.

Performance Overview

WPS Score

6.71/10

User Rating

4.6/5 (based on 11+ reviews)

Active Installations

1,000+

Update Frequency

Below Average It is calculated using the weighted average of same category plugins.

Security Score

7.1 / 10 (High Risk) It is calculated using the weighted average of all versions.

What It Does

This plugin adds WebAuthn and passkey support to the Two Factor plugin, providing a modern, secure authentication method.

Features include support for WebAuthn and passkeys such as Windows Hello, Touch ID, and YubiKeys. It is backward compatible with previously registered U2F security keys and offers a user-friendly settings interface for seamless authentication.

Additionally, it allows customizable error logging and behavior via action hooks. The plugin works with the Two Factor plugin to provide flexible two-factor authentication options.

This plugin enables users to register and use hardware security keys and platform authenticators for stronger protection against password-based attacks and phishing.

Comparing to Alternatives

WebAuthn Provider for Two Factor offers a specialized approach to two-factor authentication using WebAuthn standards, distinguishing itself from other multi-factor plugins.

Top alternatives

Strengths

Supports FIDO/U2F/WebAuthn standards comprehensively
Provides a frictionless login experience with one-touch 2FA
Compatible with multiple authentication methods including fingerprint and facial recognition
No ads or unnecessary features, focusing on essential options
Quick setup, working effectively within minutes

Weaknesses

Known security vulnerability fixed only in recent update
Occasional issues with registering new authentication keys
Lacks unminified JavaScript files for easier code auditing
No pro version with extended features available

User Sentiment Analysis

With a high overall rating of 4.6 out of 5 based on 11 reviews, users generally appreciate the plugin's functionality and ease of use, though a small minority report issues.

Positive highlights

'Fixes FIDO/U2F/WebAuthn functionality' - Olav Seyfarth
'Thank you for bridging the gap while we wait for the PR. This is what Open Source is all about.' - con
'Works well for my use case but please provide unminified JS files.' - Rene Hermenau
'One touch 2FA is a dream' - Steven Gliebe
'Working like a charm! Frictionless login experience for WordPress users.' - meksONE

Common complaints

Unable to register new authentication keys after recent updates

Weaknesses

Security vulnerability with 2FA bypass fixed only in version 2.5.6
Lack of unminified JavaScript files complicates code auditing
No premium version limits advanced feature availability

Who Should Use This?

Best for

Users seeking a straightforward, standards-compliant WebAuthn two-factor authentication plugin with quick setup and minimal configuration.

Not ideal for

Sites requiring advanced premium features or those needing guaranteed immediate resolution of registration issues may find this plugin less suitable.

Pricing & Value

Free version includes

The free version offers full WebAuthn-based two-factor authentication support with essential features and compatibility with various authentication methods.

Final Verdict

WebAuthn Provider for Two Factor is a robust and user-friendly plugin that effectively implements WebAuthn standards for two-factor authentication. Its high user ratings reflect satisfaction with its ease of use and compatibility, although some users have experienced registration issues.

While it lacks a premium version and had a notable security vulnerability now fixed, it remains a strong choice for those prioritizing open-source, standards-based 2FA solutions. Users needing advanced features or guaranteed flawless registration might consider alternatives.