內容簡介
Rapls Passkey 外掛為 WordPress 提供無密碼登入功能，透過 Touch ID、Windows Hello、Face ID 或安全金鑰取代傳統密碼，並確保伺服器僅保存公開金鑰，增強安全性。
【主要功能】
• 無密碼、抗釣魚登入（WebAuthn / FIDO2）
• 同裝置通行金鑰（Touch ID / Windows Hello / Face ID）
• 跨裝置登入支援（瀏覽器原生通行金鑰流程）
• 短碼和 Gutenberg 區塊嵌入登入管理
• 管理個別通行金鑰（重命名、暫停、恢復）
• 站點範圍通行金鑰列表（可搜尋）
外掛標籤
開發者團隊
② 後台搜尋「Rapls Passkey – Passwordless Login with WebAuthn」→ 直接安裝（推薦）
原文外掛簡介
Rapls Passkey adds passkey sign-in to WordPress. Touch ID, Windows Hello, Face
ID or a security key takes the place of the password, and your server never
holds a shared secret — only a public key, which is useless to anyone who
steals it.
It is built to run where most WordPress sites actually run:
No PHP extension to install. Nothing beyond what WordPress itself already needs. In particular gmp is not required, so there is nothing to ask your shared host for and nothing that stops working when the server’s PHP is upgraded.
Nothing leaves your site. The passkey ceremony happens between the browser and your own server. No account, no API key, no third-party service in the login path.
Passwords keep working. Password login is never switched off in the free plugin. Nobody gets locked out while a site moves across.
Japanese UI included. Fully translated, alongside the English source.
What the free plugin does
Passwordless, phishing-resistant sign-in (WebAuthn / FIDO2)
Same-device passkeys (Touch ID / Windows Hello / Face ID)
Cross-device sign-in using the browser’s native passkey flow when the browser offers it (scan with your phone). A custom QR approval flow is available in Pro.
Shortcodes and Gutenberg blocks (login / passkey management) you can embed on any page
Rename, suspend and resume individual passkeys — a device that is temporarily out of reach can be cut off without destroying the credential
A site-wide passkey list for administrators (Users -> Passkeys), searchable by owner or name
Works with two-factor plugins (Wordfence Login Security, Two-Factor, …): a passkey counts as the second factor, while weaker alternative logins must still pass the site’s 2FA
An audit log of registrations, sign-ins and removals, exportable as CSV
WP-CLI commands, a first-run configuration check, and an emergency bypass constant
Fully translatable UI (English source; translations come from translate.wordpress.org)
Shortcodes
Embed them in any page, post, or widget. In the block editor they are also available as the “Sign in with a passkey” and “Manage passkeys” blocks.
[rapls_passkey_login] — a passkey sign-in button for logged-out visitors. Supports the redirect (URL to go to after success) and label (button text) attributes.
[rapls_passkey_register] — a management UI where logged-in users can register and remove their own passkeys.
Requirements
WordPress 6.0 or later
PHP 8.2 or later
HTTPS, except on localhost — browsers refuse WebAuthn without it
No PHP extension beyond WordPress’s own requirements.
Rapls Passkey Pro
Everything above is free, and stays free. Pro is a separate add-on for the part
that comes after the first passkey: moving a whole site across, and keeping a
way in when a device goes missing.
Sign in from another device — approve a login on your computer from your phone, with a QR code and a four-digit confirmation code so a relayed code cannot be used elsewhere
A way back in that is not a password — one-time recovery codes and email magic-link sign-in
Roll out by role — require passkeys for the roles you choose, with a grace period, then turn password login off once everyone is across
Adaptive step-up — ask for a passkey again after a password sign-in from somewhere unfamiliar
Authenticator policy — FIDO Metadata Service checks, AAGUID allow and deny lists, trusted-device management
Operations — security webhooks, adoption reports, multisite network settings, WP-CLI
One-time purchase, no subscription, with a year of updates and a 14-day refund.
Details and pricing
External services
This plugin sends nothing to any external service by default. One optional
integration, off unless you turn it on, contacts a third party:
Google reCAPTCHA v3 — used only when you enable reCAPTCHA for password
logins. When it is on, the visitor’s browser loads
https://www.google.com/recaptcha/api.js, and the plugin sends the resulting
token together with the request IP address to
https://www.google.com/recaptcha/api/siteverify so that Google can score the
request. Nothing is sent while the option is off. This service is provided by
Google and its use is governed by Google’s terms and privacy policy:
Terms of Service: https://policies.google.com/terms
Privacy Policy: https://policies.google.com/privacy
No other host is contacted. The plugin bundles the public suffix list it needs
(data/public_suffix_list.dat) rather than fetching it, and passkey ceremonies
happen between the browser and your own site.
Privacy
Authentication data is stored on your own site.
What is stored:
Passkey credential records (public key, credential ID, sign counter, a label and timestamps) in a custom database table.
A per-user WebAuthn user handle in user meta, plus one row in the options table recording that the account has one. The handle carries nothing about the person: for accounts created from this version it is derived from the account id and a site secret, and accounts that already had a random handle keep it.
An optional audit log of passkey events (registration, sign-in, removal) with the acting user, IP address and timestamp.
Retention and removal:
Passkey records remain until the user or an administrator deletes them; deleting a user removes their passkey records.
The plugin integrates with WordPress’s built-in personal-data export and erase tools, so a user’s passkey and audit data are included in export/erase requests.
Uninstalling the plugin (delete from the Plugins screen) drops its custom table and options.
This plugin does not use cookies for tracking. It sets only short-lived, functional cookies during a login ceremony (for example the pending second-factor login), which expire within minutes.
