Passkeys and WordPress Login Security: What’s Actually Available Right Now

Every few months a support ticket comes in asking why WordPress doesn’t just support passkeys natively yet, the way a bank app or a big tech login screen does. The honest answer, as of writing this in August 2026, is that WordPress core still has no built-in WebAuthn or passkey login — I checked core.trac.wordpress.org directly and there’s no active core ticket for it. If you want passkeys on a WordPress site, you’re installing a plugin, and it’s worth knowing which ones actually exist before you go looking.

What’s actually available

Three plugins on wordpress.org currently implement WebAuthn/passkey login, and none of them are big by install-count standards: WP-WebAuthn (2,000+ active installs, last updated a few months ago, tested up to WP 6.9.7), Secure Passkeys (1,000+ installs, tested to WP 7.0.4), and WebAuthn Provider for Two Factor — a companion add-on for the established Two Factor plugin, also around 1,000 installs. A handful of smaller entries exist under the wordpress.org passkey tag, but their install counts aren’t large enough to cite with confidence.

That’s the real picture: passkey login on WordPress is a real, working thing, but it’s still a niche plugin category, not a mainstream feature most site owners have heard of, let alone installed.

Why passkeys are worth the friction of setting one up

The FIDO Alliance — the industry body behind the passkey standard — published a Passkey Index in October 2025 based on data from nine member companies including Amazon, Google, Microsoft, and PayPal. Their self-reported numbers: 93% of accounts were passkey-eligible, 36% of eligible users had enrolled one, and passkeys were used in 26% of sign-ins where available. The login success rate was 93% for passkeys versus 63% for passwords, with sign-in reported as 73% faster and generating 81% fewer help-desk tickets.

I’d flag those numbers for what they are: self-reported by FIDO’s own member companies, not an independent audit. But the direction is consistent with what you’d expect mechanically — a passkey can’t be phished the way a password can, because it’s cryptographically tied to the specific domain it was created for. There’s no password to leak in a breach, because there isn’t one.

A passkey isn’t a stronger password. It’s the removal of the thing that makes passwords vulnerable in the first place — a secret that has to be typed, remembered, and is therefore stealable.

The security context that actually justifies this

Patchstack’s “State of WordPress Security in 2026” report — I pulled this directly — recorded 11,334 newly disclosed vulnerabilities across the WordPress ecosystem in 2025, up 42% year over year. 91% of those were in plugins, not core. Sucuri’s separate malware trends report found roughly 1.66% of scanned sites infected, with malware and malicious redirects accounting for nearly 75% of infections. Neither of these numbers is specifically about login security, but they establish the baseline: a WordPress site is a real, ongoing target, and login credentials are one of the more direct paths in.

I want to be careful here about a specific claim I couldn’t verify: some secondary sources cite dramatic Wordfence brute-force statistics — attack frequency, campaign sizes — that I could not confirm directly against Wordfence’s own published data in this research. Wordfence does publish a genuine, real Quarterly Threat Intelligence Report series, and I’d point you to that directly rather than repeat unverified numbers from an aggregator blog.

What I’d actually do

• If you’re technically comfortable, install one of the WebAuthn plugins as an additional login option, not a replacement — keep password + 2FA available as a fallback until passkey support matures further across the ecosystem.
• Prioritize this for admin and editor accounts first. Given how concentrated WordPress vulnerabilities are in the plugin layer, protecting the accounts with elevated capabilities matters more than protecting a subscriber-level account.
• Don’t wait for core support before doing anything. There’s no confirmed WordPress core roadmap item for this yet, and plugin-based passkey support already works today.
• Pair it with the fundamentals that still matter regardless — unique passwords where passwords are still used, and genuine two-factor authentication, not just an SMS code.

Passkeys on WordPress are real, they work, and the underlying security logic is sound. What’s missing isn’t the technology — it’s adoption. Given how small the current install numbers are, being an early mover here is a genuine, if slightly inconvenient, security upgrade rather than a mainstream expectation yet.