內容簡介
Passwordless X1280 外掛將 WordPress 與 X1280 密碼無需認證伺服器整合，透過用戶智能手機內建的生物識別功能（如 Face ID 和指紋辨識）實現安全的無密碼登入，消除密碼重置和釣魚風險。
【主要功能】
• 支援無密碼登入選項
• 安全的 WebAuthn / 密鑰認證
• 管理員設定面板配置 X1280 伺服器
• 可選擇禁用基於密碼的登入
• 雙向認證防止釣魚攻擊
外掛標籤
開發者團隊
原文外掛簡介
Passwordless X1280 integrates WordPress with the X1280 Passwordless Authentication Server, enabling secure passwordless login through the biometric capabilities already built into your users’ smartphones — Face ID and fingerprint recognition — based on the ITU-T X.1280 international standard.
Forget passwords, password resets, and phishing risks. Instead of asking users to type a password, your site presents an automatic password that users simply verify and approve in the Passwordless X1280 mobile app.
Why Passwordless X1280?
Built on the ITU-T X.1280 international standard – a globally recognized passwordless authentication framework designed for the zero-trust era.
Mutual authentication – users verify the service before authenticating, helping prevent phishing and fraudulent login pages.
Smartphone-based biometrics – authenticate securely with Face ID or fingerprint recognition, even when the computer itself has no biometric hardware (out-of-band authentication).
No additional hardware required – works with existing smartphones and browsers; no security keys or dedicated sensors to buy.
Free for B2C online services – provided by the non-profit Passwordless Alliance to promote safer digital services worldwide.
How It Works
Unlike traditional login systems where only the user is authenticated, X.1280 introduces mutual authentication:
The WordPress login page displays a unique auto-password.
The user checks that the same auto-password appears in the Passwordless X1280 mobile app.
After confirming the service identity, the user approves the login with smartphone biometrics.
Authentication completes securely — no password is typed or transmitted.
This ensures users are communicating with the legitimate website before any authentication takes place.
Key Features
Adds a Password / Passwordless login option to wp-login.php
Secure WebAuthn / passkey-based authentication
Admin settings panel for X1280 server configuration
Option to disable password-based login entirely
Uses WordPress hooks only — no core file modifications
Compatible with multisite environments
Works alongside caching and security plugins
Automatic Page Creation
Upon activation, the plugin automatically creates the following pages:
Passwordless X1280 Login Page – displays the passwordless login interface using the [px1280_login] shortcode
Passwordless X1280 Register / Unregister Page – lets users register and manage passkeys using the [px1280_manage] shortcode
Both pages can be edited or reassigned from the WordPress admin panel if needed.
Security
No passwords are transmitted during passwordless authentication
Out-of-band approval on a separate trusted device (the user’s smartphone)
Uses WordPress nonces and secure server-side verification
Requires HTTPS (a WebAuthn requirement)
Does not modify WordPress core files
Requirements
A WordPress site served over HTTPS
Users need a smartphone with the free Passwordless X1280 mobile app (App Store / Google Play)
A Server Key for the X1280 Authentication Server (see the FAQ for how to obtain one)
External Services
This plugin connects to an external service to enable passwordless authentication.
Service name: X1280 Authentication Server
Service URL: http://wp-x1280.dualauth.com
Service provider: Passwordless Alliance
Purpose: the service processes passwordless authentication requests using WebAuthn (passkeys).
Data sent:
Username (userId)
Authentication session data (token, random, sessionId)
Server key (for verification)
Data received:
Authentication result (approved / denied)
Service password (OTP)
Push notification data
When data is sent:
During login (passwordless authentication)
During registration / unregistration of passkeys
About the Passwordless Alliance
The Passwordless Alliance is a non-profit organization headquartered in Geneva that distributes Passwordless X1280 software free of charge to B2C online services worldwide. The underlying technology is standardized by the ITU-T as Recommendation X.1280.
