Rapls Passkey Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
Rapls Passkey lets users sign in to WordPress with passkeys (WebAuthn / FIDO2).
- Passwordless, phishing-resistant sign-in
- Same-device passkeys (Touch ID / Windows Hello)
- Cross-device sign-in using the browser’s native passkey flow when the browser offers it (scan with your phone). A custom QR approval flow is available in Pro.
- Shortcodes and Gutenberg blocks (login / passkey management) you can embed on any page
- Rename, suspend and resume individual passkeys — a device that is temporarily out of reach can be cut off without destroying the credential
- A site-wide passkey list for administrators (Users -> Passkeys), searchable by owner or name
- Works with two-factor plugins (Wordfence Login Security, Two-Factor, …): a passkey counts as the second factor, while weaker alternative logins must still pass the site’s 2FA
- Fully translatable UI (English source with a bundled Japanese translation)
Shortcodes
Embed them in any page, post, or widget. In the block editor they are also available as the “Sign in with a passkey” and “Manage passkeys” blocks.
[rapls_passkey_login]— a passkey sign-in button for logged-out visitors. Supports theredirect(URL to go to after success) andlabel(button text) attributes.[rapls_passkey_register]— a management UI where logged-in users can register and remove their own passkeys.
Requirements
- PHP 8.2 or later
- WordPress 6.0 or later
- HTTPS (except on localhost)
External services
This plugin sends nothing to any external service by default. One optional
integration, off unless you turn it on, contacts a third party:
Google reCAPTCHA v3 — used only when you enable reCAPTCHA for password
logins. When it is on, the visitor’s browser loads
https://www.google.com/recaptcha/api.js, and the plugin sends the resulting
token together with the request IP address to
https://www.google.com/recaptcha/api/siteverify so that Google can score the
request. Nothing is sent while the option is off. This service is provided by
Google and its use is governed by Google’s terms and privacy policy:
- Terms of Service: https://policies.google.com/terms
- Privacy Policy: https://policies.google.com/privacy
No other host is contacted. The plugin bundles the public suffix list it needs
(data/public_suffix_list.dat) rather than fetching it, and passkey ceremonies
happen between the browser and your own site.
Privacy
Authentication data is stored on your own site.
What is stored:
- Passkey credential records (public key, credential ID, sign counter, a label and timestamps) in a custom database table.
- A per-user WebAuthn user handle in user meta, plus one row in the options table recording that the account has one. The handle carries nothing about the person: for accounts created from this version it is derived from the account id and a site secret, and accounts that already had a random handle keep it.
- An optional audit log of passkey events (registration, sign-in, removal) with the acting user, IP address and timestamp.
Retention and removal:
- Passkey records remain until the user or an administrator deletes them; deleting a user removes their passkey records.
- The plugin integrates with WordPress’s built-in personal-data export and erase tools, so a user’s passkey and audit data are included in export/erase requests.
- Uninstalling the plugin (delete from the Plugins screen) drops its custom table and options.
This plugin does not use cookies for tracking. It sets only short-lived, functional cookies during a login ceremony (for example the pending second-factor login), which expire within minutes.
Screenshots
Sign in with a passkey from the normal WordPress login screen.
The browser offers the passkeys saved for this site.
Your registered passkeys: rename, suspend or delete each one.
Registering a passkey from your profile screen.
Touch ID confirms before the passkey is saved.
Choose where the passkey is stored.
The first-run check: HTTPS, the relying-party ID, and the WebAuthn library.
Every registration, sign-in and removal, exportable as CSV.
