WP Manifestindependent plugin directory
manifest / unclassified / sw-securelogin

SW Securelogin

Modular authentication platform. Passkey registration and login preview; password login remains available.

by sw-wordpress · github.com/sw-wordpress/sw-securelogin

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/sw-wordpress/sw-securelogin/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/sw-wordpress/sw-securelogin ↗

Adds passkey login to the WordPress login page. Password login stays available. Preview, disabled until an administrator enables it.

Features

  • Passkey login — Sign in on the standard WordPress login page with username or email plus passkey.
  • Up to ten passkeys per user — Each user adds, renames and removes their own passkeys in the profile.
  • Password fallback — Password login keeps working; disabling the plugin never locks anyone out.
  • No external services — All data stays in your WordPress database; no tracking.

Languages

English, German.

Usage

  1. Open SW Securelogin → Overview, tick Enable passkey registration and login and save.
  2. Each user opens Users → Profile → My passkeys, confirms with the current password and clicks Add passkey.
  3. On the login page, enter the username or email address and click Sign in with a passkey. Log in with password remains available.

Configuration

Requirements

PHP 8.2+ with OpenSSL, WordPress 6.7+, MySQL or MariaDB, single-site installation, HTTPS.

Settings

The only setting is the switch under SW Securelogin → Overview. Enabling it binds passkeys to the current site address; changing the domain later is not supported yet.

Asset URLs use the central plugin version automatically. There are no user-configurable plugin constants. These existing wp-config.php settings matter:

// Must be off (default). Passkeys are disabled while SQL query logging is active.
define( 'SAVEQUERIES', false );

// Proxy TLS recognition belongs in the trusted server configuration.
// Validate the proxy peer and prevent direct access before trusting its headers.
// Deployment instructions: docs/OPERATIONS.md.

Background tasks

Expired login attempts are removed hourly by WP-Cron. On sites with little traffic or with DISABLE_WP_CRON, run WordPress cron from the server, e.g. */15 * * * * wp cron event run --due-now --path=/path/to/wordpress.

Integrations

WP Armour and WPS Hide Login have been checked with a renamed login path. Unreviewed MFA extensions block passkey authentication; password/MFA recovery stays with WordPress and the extension. See release verification for tested versions and limits.

Deactivation and removal

Deactivation always keeps data. Deletion keeps data by default. Administrators can opt into permanent removal under SW Securelogin > Overview > Data on plugin deletion and confirm the warning before saving. This removes plugin data only when WordPress deletes the plugin; WordPress users, passwords and sessions remain. Personal data can be exported or erased with the WordPress privacy tools, and a user's passkeys are removed when the user is deleted. Details: privacy, backup, upgrade and administrator recovery.

Troubleshooting

Problem Solution
The passkey button does not appear. Check that the site runs on HTTPS, SAVEQUERIES is off and the feature is enabled.
Notice about a "reviewed passkey adapter". Another security or login plugin hooks into the login. Passkey login stays blocked for safety; use the password.
Lost device. Sign in with your password and remove the lost key under My passkeys.

Built with AI

This plugin was implemented with AI assistance. Why it exists and how AI is used: sw-wordpress manifest.

AI agents must follow the project rules before changing code:

Development

Requirements: PHP 8.2+ with ZipArchive, Composer, Node.js with npm, and Docker for the production build. JavaScript and CSS are plain files; there is no frontend compile step.

composer install
npm ci --ignore-scripts
npx playwright-core install --with-deps chromium   # browser tests only

composer lint && composer cs && composer analyse   # syntax, WordPress coding standards, PHPStan
composer test                                      # unit tests
composer test:integration                          # needs a disposable WordPress, see docs/TESTING.md
npm run lint && npm run test:e2e                   # JavaScript checks and browser tests

composer build:release                             # production ZIP and SHA-256 in build/

Every change needs tests; line coverage must stay above 80 % for PHP and JavaScript. Setup of the test site, coverage and SonarQube: docs/TESTING.md, docs/SONARQUBE.md. GitHub Actions run all checks on every push.

License

GPL-2.0-or-later — see LICENSE. Provided by Stefan Warnat.

Bundled third-party components (license texts in vendor-prefixed/licenses/ of the release build):