/ Plugin Category

/ Security & Privacy

/ Security Scanning & Malware Protection

/ WP-WebAuthn

WP-WebAuthn

By Axton

Security & Privacy / Security Scanning & Malware Protection

Reviewed by Omar Dabbas

Trusted WordPress expert with 20+ years of experience evaluating plugins for the WP ecosystem.

WP-WebAuthn Review - In-Depth Analysis

WP-WebAuthn enables passwordless login through FIDO2 and U2F devices like Passkey, FaceID or Windows Hello for your site.

Performance Overview

WPS Score

6.78/10

User Rating

4.5/5 (based on 17+ reviews)

Active Installations

2,000+

Update Frequency

Below Average It is calculated using the weighted average of same category plugins.

Security Score

5 / 10 (Medium Risk) It is calculated using the weighted average of all versions.

What It Does

WebAuthn is a new way for you to authenticate in web. It helps you replace your passwords with devices like Passkeys, USB Keys, fingerprint scanners, Windows Hello compatible cameras, FaceID/TouchID and more. Using WebAuthn, you can login to your a website with a glance or touch.

When using WebAuthn, you just need to click once and perform a simple verification on the authenticator, then you are logged in. No password needed. If your device supports Passkey, your authenticator can roam seamlessly across multiple devices for a more convenient login experience.

WP-WebAuthn is a plug-in for WordPress to enable WebAuthn on your site. Just download and install it, and you are in the future of web authentication.

WP-WebAuthn also supports usernameless authentication.

This plugin has 4 built-in shortcodes and 4 built-in Gutenberg blocks, so you can add components like register form to frontend pages.

Please refer to the documentation before using the plugin.

This plugin currently has BETA multisite support, if you find any issue in multisite, feel free to open an issue on GitHub.

PHP extensions gmp and mbstring are required.

WebAuthn requires HTTPS connection or localhost to function normally.

You can contribute to this plugin on GitHub.

Please note that this plugin does NOT support Internet Explorer (including IE 11). To use FaceID or TouchID, you need to use iOS/iPadOS 14+.

WebAuthn has become a W3C Recommendation since March 2019, which enabling the creation and use of strong, attested, scoped, public key-based credentials by web applications, for the purpose of strongly authenticating users using hardware authenticators. WebAuthn focuses on both security and privacy, it offers the possibility to create a secure authentication process without having to transfer any private data such as recognition data and fingerprint data. It will be the future of web authentication.

When authenticating with WebAuthn, no private data will leave user’s device and no third-party involvement. The credentials transferred are not associate to any user’s information but only for authentication. It’s GDPR Friendly.

Comparing to Alternatives

WP-WebAuthn offers a focused solution for passwordless WordPress login using passkeys, standing out among several two-factor authentication plugins available.

Top alternatives

Strengths

Straightforward implementation of passwordless login.
Simple and easy setup process.
Works well with the latest WordPress versions.
Focused on passkey-based authentication for enhanced security.
Good potential for future development.

Weaknesses

Known medium severity security vulnerabilities with some unfixed issues.
Limited support for Android device passkey registration.
No pro version or advanced premium features.
Smaller user base compared to some alternatives.

User Sentiment Analysis

With a high overall rating of 4.5 stars and most users praising its ease of use and functionality, WP-WebAuthn is well-regarded. However, a small portion of users report issues, particularly with Android compatibility and passkey registration failures.

Positive highlights

"Straightforward implementation of passkeys for WordPress admin login, nice!" — wpnpc420
"Simple setup. It does exactly what I need." — pigom
"Great plugin, so much potential, easy to install and to configure." — pixelarmx
"Works with the latest version of WP Thanks and keep developing please?" — fakeologist

Common complaints

Cannot get plugin to work on Android devices for passkey creation.
Passkey registration fails despite successful import by password managers.

Weaknesses

Medium severity security vulnerabilities with some unfixed issues.
Limited Android device support for passkey registration.
No advanced features due to lack of a pro version.

Who Should Use This?

Best for

Users seeking a straightforward, passwordless login solution for WordPress admin accounts who prioritize ease of setup and use.

Not ideal for

Users who require robust Android device support for passkey registration or need a plugin with advanced premium features and guaranteed security patches.

Pricing & Value

Free version includes

The free version provides full functionality for passwordless login using passkeys without restrictions.

Final Verdict

WP-WebAuthn is a solid choice for WordPress users looking to implement passwordless authentication with passkeys. It offers a simple setup and works well for most desktop users, earning praise for its straightforward approach and potential. However, the plugin has some security vulnerabilities that are partially unresolved and limited support for Android devices, which may affect some users.

While there are several alternatives with broader features and more comprehensive support, WP-WebAuthn stands out for its focused functionality and ease of use. Users should weigh the current security concerns and device compatibility issues against their needs before choosing this plugin.

Other Notable Features

Here are a few other notable features of this free WP-WebAuthn plugin.

Fido

Passkey

Security

Webauthn

Screenshots

FAQ

This plugin supports English, Chinese (Simplified), Traditional Chinese (Hong Kong), Traditional Chinese (Taiwan), Turkish, French & German currently. If you are using WordPress in none of those languages, English will be displayed as default language.

All translation files are hosted on translate.wordpress.org and GitHub. You can help us to translate WP-WebAuthn into other languages!