Wordfence 9 adds free passkeys for WordPress login
Wordfence passkeys have arrived in Wordfence 9 as a free login option for WordPress sites. A passkey is a digital credential stored on a device that lets a person sign in with a fingerprint, a face scan, a device PIN, or a password manager, without remembering or typing a password. Wordfence explains that this removes friction for everyone: the site owner logs in with one click, and users on a WooCommerce store or WordPress-powered website can do the same when they want to make a purchase, post in a forum, or simply engage with the site. The company notes that at scale, even a small reduction in login friction can produce large gains in completed checkouts, participation, and return visits. Mark Maunder, Wordfence Founder and CEO, says the feature is one he is particularly proud of because most security controls add friction, while passkeys remove it. On mobile, the friction is even lower because users can rely on fingerprint or facial recognition.
Wordfence describes passkeys as a stronger anti-phishing measure when passwords are removed. Phishing is a scam in which attackers try to steal a password by tricking a person into typing it into a fake site or message. If password sign-in is disabled and only passkeys are allowed, there is no password for an attacker to steal, phish, or reuse. Wordfence says security usually adds friction, from having to log in, to using two-factor authentication (2FA), which asks for a second proof of identity beyond a password, to password changes and basic hygiene. The company argues that passkeys invert that pattern: the more login friction you remove by disabling passwords, the more secure that login layer becomes. Wordfence positions this as part of defense in depth, meaning a site uses several independent security layers so that if one fails, others still protect it. Passkeys protect the login layer specifically by removing the password an attacker would otherwise target.
The feature is available in both the free and paid versions of Wordfence, and Wordfence says it takes about a minute to enable. Wordfence points out that passkeys have historically been a feature other WordPress security plugins charged for. Its own policy, the company says, is to charge only when providing a feature costs money to run; because passkeys are an algorithmic implementation that is free for Wordfence to provide, the company has made them completely free. The implementation also supports multiple passkeys across multiple devices, which reduces the chance that an administrator locks themselves out if one device is lost. To get started, a site owner opens Wordfence, then Login Security. Wordfence notes that editing Login Security Settings typically requires the administrator role. On the Settings tab, the owner switches Enable passkeys on. Every role then defaults to Optional, meaning users may register a passkey but can still sign in with a password. Setting a role to Required disables password sign-in for that role, which Wordfence calls the stronger anti-phishing position.
After enabling passkeys, the site owner goes to the My Passkeys tab, gives the new passkey a name, and selects the plus sign to add it. The device then asks for a fingerprint, a face scan, a PIN, or a password manager. Wordfence advises registering a passkey on each device the owner uses, so losing one does not lock them out. The same screen lets the owner choose whether a password remains available as a backup, or whether the account signs in with Passkeys only. Wordfence warns that before signing out, site owners who choose Passkeys only should test their passkeys. Once set, the WordPress login screen offers Log In with a Passkey, and there is no password to remember, retrieve, or type. Wordfence calls this passwordless login: signing in without having to supply a password at all.
For site owners and administrators, the practical benefit is a login that is faster for them and for every registered user. Wordfence recommends enabling passkeys and promoting them to users to immediately reduce friction and boost engagement. The feature does not replace the rest of Wordfence, which offers a range of security controls; instead it strengthens one layer of a site's defense in depth. Because passkeys are available in the free plugin, even small site owners can add this control without an additional subscription. For site owners on managed WordPress hosting such as AEU Hosting, enabling Wordfence passkeys is a simple account-level change that sits alongside the platform's existing server-side security hardening, automatic backups, SSL and expert support, and it does not require hosting configuration changes.