內容簡介
Sigil 外掛為 WordPress 登入提供第二層身份驗證，使用者可透過註冊通行密鑰、身份驗證應用程式、備用代碼或電子郵件代碼來增強安全性，管理員可針對特定角色強制啟用雙因素身份驗證。
【主要功能】
• 支援通行密鑰（WebAuthn）及硬體安全金鑰
• 兼容任何 RFC 6238 的身份驗證應用程式
• 提供備用代碼及電子郵件代碼選項
• 可依角色強制啟用雙因素身份驗證
• 允許用戶在前端頁面設置身份驗證方法
• 支援多網站網絡的統一管理
外掛標籤
開發者團隊
② 後台搜尋「Sigil – Passkeys and Two-Factor Authentication」→ 直接安裝（推薦）
原文外掛簡介
Sigil protects WordPress sign-in with passkeys, authenticator apps, backup codes and email codes. Anyone with a passkey can sign in with Face ID, Touch ID, Windows Hello or a security key and skip the password. Administrators can require a second factor for chosen roles, and a short setup wizard gets the first administrator enrolled before anything is enforced.
Sign in without a password
The login screen shows a “Sign in with a passkey” button, and browsers that support it offer saved passkeys in the username field. A passkey pairs the device you hold with your fingerprint, face or device PIN, so it counts as the full sign-in on its own. Older security keys that can’t store a passkey keep working as a second factor after the password. Passkeys need PHP 8.0 or newer.
Methods
Passkeys (WebAuthn), from a phone, laptop or hardware security key, as a password replacement or as the second step.
Authenticator app (TOTP), compatible with any RFC 6238 app. Password managers that store one-time codes can fill it in.
Backup codes: ten single-use codes, shown the first time any method is set up.
Email codes: a six-digit code sent to the account’s email address.
Enrol before you enforce
The wizard walks the first administrator through adding a passkey or an authenticator app and saving backup codes, then offers to require 2FA for roles.
Sigil won’t let an administrator require 2FA for their own role until they’ve set up a method themselves.
A grace period gives existing users time to enrol before the requirement starts.
“Remember this device” skips the second step on a trusted browser for as many days as you allow, and each user can forget their trusted devices at any time.
Enforcement
Require 2FA per role, or for everyone with a chosen capability.
A “2FA” column on the Users screen shows who has set it up.
People who become subject to a requirement get an email with their deadline. Users are emailed when a second factor is added to or removed from their account.
Protection against password guessing
Wrong passwords are counted per account and per IP address, across wp-login.php, XML-RPC, the REST API and AJAX login forms. After five wrong passwords, password sign-in for that account pauses for 15 minutes, and repeat pauses get longer, up to an hour. A passkey still signs the owner in during a pause, and the refusal looks the same whether or not the account exists. Sites that already run another limiter can switch this one off.
WooCommerce and sites without the dashboard
Put [sigil_2fa] on any page and users can set up and manage their methods there. Enforcement sends people to that page instead of to an admin screen they can’t open. On WooCommerce stores, customers manage two-factor authentication from a tab in My Account.
Multisite
Accounts are network-wide in WordPress, so second factors are too. An authenticator or backup codes cover every site on the network, the policy is set once under Network Admin, and wrong second-factor codes are counted across the network. Resetting another user’s 2FA is a Network Admin action there, which is how WordPress governs user editing on a network.
Passkeys are bound to the domain they were created for, so by default a passkey covers the site it was registered on. A network under one operator can widen that to every subdomain site with the sigil_rp_id filter. It’s opt-in because widening lets any site under that domain request passkey sign-ins, which matters when sites have different administrators.
REST API
A decoupled front end can handle sign-in itself through routes under sigil/v1. They run the passwordless passkey sign-in and the login challenge, read, reset or remove a user’s methods, and read and edit the policy. The challenge routes are authenticated by the token issued after the password step. Everything else needs the same capability as the matching screen.
Recovery
Several ways back in if a second factor is lost:
Backup codes, saved at setup.
A user with the edit_users capability can reset another user’s 2FA from the Users screen.
wp sigil reset
wp sigil unlock
Application passwords
Two-factor authentication doesn’t apply to application passwords, which authenticate REST API and XML-RPC requests. The settings screen explains this, and application passwords can be disabled per role. The account password itself is refused on XML-RPC and REST for anyone with a second factor, because those requests never reach the second step.
Third-party libraries
QR Code Generator for JavaScript 2.0.4 by Kazuhiko Arase, MIT licensed, bundled unmodified at assets/js/vendor/qrcode.js (https://github.com/kazuhikoarase/qrcode-generator). Draws the authenticator QR in the browser.
WebAuthn by Lukas Buchs, bundled in vendor/, used to verify passkey registrations and assertions.
Neither contacts an external service.
