Sigil – Passkeys And Two-Factor Authentication Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
Sigil adds a second authentication step to WordPress logins. Users enrol a passkey, an authenticator app, backup codes or email codes from their profile, and administrators can require 2FA for chosen roles with a grace period.
Methods
- Passkeys (WebAuthn), using a platform authenticator such as Face ID, Touch ID or Windows Hello, or a hardware security key. Requires PHP 8.0 or newer.
- Authenticator app (TOTP), compatible with any RFC 6238 application.
- Backup codes: ten single-use codes, generated the first time any method is set up.
- Email codes: a six-digit code sent to the account email address.
Enforcement
- Require 2FA per role, or for everyone with a chosen capability.
- Set a grace period so existing users get time to enrol instead of being locked out on the next login.
- A “2FA” column on the Users screen shows who has set it up and who has not.
Recovery
Three ways back in if a second factor is lost:
- Backup codes are generated and displayed at first enrolment.
- A user with the
edit_userscapability can reset another user’s 2FA from the Users screen. wp sigil reset <user>clears a user’s second factor from the command line when no one can reach the dashboard.
Application passwords
Two-factor authentication does not apply to application passwords, which authenticate REST API and XML-RPC requests. The settings screen documents this, and application passwords can be disabled per role.
Screenshots
No screenshots provided
