Passwordless X1280 Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
Passwordless X1280 integrates WordPress with the X1280 Passwordless Authentication Server, enabling secure passwordless authentication using smartphone biometrics and the ITU-T X.1280 international standard.
Forget passwords, password resets, and phishing risks. Passwordless X1280 allows users to authenticate using the biometric capabilities already available on their smartphones, including Face ID and fingerprint recognition.
Why Passwordless X1280?
- Built on the ITU-T X.1280 International Standard – A globally recognized passwordless authentication framework designed for the zero-trust era.
- Mutual Authentication Protection – Users verify the service before authentication, helping prevent phishing and fraudulent login pages.
- Smartphone-Based Biometrics – Authenticate securely with Face ID or fingerprint recognition, even when the computer itself has no biometric hardware.
- No Additional Hardware Required – Works with existing smartphones and browsers without requiring security keys or specialized devices.
- Free to Use – Provided as part of the Passwordless Alliance initiative to promote safer digital services worldwide.
How It Works
Unlike traditional login systems where only the user is authenticated, X.1280 introduces Mutual Authentication.
- The WordPress login page displays a unique Auto-Password.
- The user verifies the same Auto-Password in the Passwordless X1280 mobile application.
- After confirming the service identity, the user approves the login using smartphone biometrics.
- Authentication is completed securely without transmitting passwords.
This process ensures users are communicating with the legitimate website before any authentication occurs.
Security Advantages
- Resistant to phishing and credential theft attacks
- Out-of-band authentication through a separate trusted device
- No password storage or password transmission during authentication
- Strong biometric verification using smartphone security capabilities
- Suitable for modern zero-trust security environments
Key Features
- Adds a passwordless login option to
wp-login.php - Secure WebAuthn / Passkey-based authentication
- Admin settings panel for X1280 server configuration
- Option to disable password-based login
- Uses WordPress hooks (no core file modifications)
- Compatible with multisite environments
- Works with caching and security plugins
Automatic Page Creation
Upon activation, the plugin automatically creates the following pages:
- Passwordless X1280 Login Page – Displays the passwordless login interface using
[px1280_login] - Passwordless X1280 Register / Unregister Page – Allows users to register and manage passkeys using
[px1280_manage]
These pages can be edited or reassigned from the WordPress admin panel if needed.
Architecture Overview
- WordPress Site – Runs this plugin
- X1280 Authentication Server – Handles authentication processing
- Passwordless X1280 Mobile App – Performs biometric verification
- Communication via REST API and WebSocket (Push Server)
Configuration
After activation, go to:
Dashboard Passwordless X1280
Configure the following:
- Disable password login (optional)
- Server Key – Provided by X1280
- Authentication Server Domain (Port: 11040)
- Push Server Domain (Port: 15010)
These settings are required for communication with the X1280 authentication server.
Usage
Default Login Page
The plugin enhances wp-login.php by adding:
- Login type selector: Password / Passwordless
- Passkey-based authentication flow when Passwordless is selected
Shortcodes
You can also use:
[px1280_login]– Displays passwordless login UI[px1280_manage]– Displays passkey registration and management UI
Security
- No passwords are transmitted during passwordless authentication
- Uses WordPress nonces and secure server-side verification
- Requires HTTPS for WebAuthn compatibility
- Does not modify WordPress core files
External Services
This plugin connects to an external service to enable passwordless authentication.
Service Name: X1280 Authentication Server
Service URL: http://wp-x1280.dualauth.com
Purpose:
The service is used to process passwordless authentication requests using WebAuthn (Passkeys).
Data Sent:
– Username (userId)
– Authentication session data (token, random, sessionId)
– Server key (for verification)
Data Received:
– Authentication result (approved/denied)
– Service password (OTP)
– Push notification data
When Data is Sent:
– During login (passwordless authentication)
– During registration/unregistration of passkeys
Screenshots
No screenshots provided
