by Jean Galea 0 (0 reviews)

Sigil – Passkeys and Two-Factor Authentication

Name: Sigil – Passkeys and Two-Factor Authentication
Author: Jean Galea

Passkeys and two-factor authentication for WordPress. Sign in without a password, and enrol before you require 2FA by role.

Sigil ranks #47,842 among WordPress.org plugins with 10+ active installations, is #662 of 1,659 in the Authentication category, and was last updated Oct 29, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1.4

v0.5.4 Current Version v0.5.4

Updated 1 week ago Last Update on 29 Oct, 2026

Refreshed 1 week ago Last Refreshed on

#662 of 1,659 in Authentication Top 50% by installs Downloads -85.2% this week Actively maintained

View on WordPress.org

Rank

#47,842

— No change

Active Installs

10+

-41.2%

KW Avg Position

98.7

0.4 worse

Downloads

750

+7 today

Support Resolved

— No change

Rating

Review 0 out of 5

0 (0 reviews)

Next Milestone 20

Total Progress 50%

10+ 20+

24,669

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 5 more installs to reach 20+

Rank Changes

Current #47,842

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

0.0

0 reviews

Overall 0%

0 (0%)

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 0.5.4
Last Updated: Oct 29, 2026
Requires WP: 6.9+
Tested Up To: 7.1.4
PHP Version: 7.4 or higher
Author: Jean Galea

Support & Rating

Rating: ☆ ☆ ☆ ☆ ☆ 0
Reviews: 0
Support Threads: 0
Resolved: 0%

Keywords

2FA authentication passkeys security two factor

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

30K+ installs

#1,015

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

5M+ installs

Wordfence Security – Firewall, Malware Scan, and Login Security

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

All-In-One Security (AIOS) – Security and Firewall

MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites

700K+ installs

#86

View all Authentication plugins

Frequently Asked Questions

Common questions about Sigil – Passkeys and Two-Factor Authentication

Use one of the backup codes shown when you first set up 2FA. If you did not keep those, another administrator can reset your account from the Users screen. If nobody can get in at all, anyone with server access runs wp sigil reset <your-username> and your second factor is cleared. Someone keeps guessing my password and now I can't sign in. After five wrong passwords, password sign-in for that account pauses for 15 minutes, longer if it keeps happening, up to an hour. A passkey still signs you in during the pause. To reopen it straight away, anyone with server access runs wp sigil unlock <your-username>. Add --ip=<address> to clear an address that was paused too, and --challenge to clear wrong second-factor codes as well. A device you've told Sigil to remember also gets past the pause with the right password. Behind a proxy or CDN every visitor can share the proxy's address, so return the real visitor address from the sigil_client_ip filter, and only when your proxy sets it.

No. All authentication happens on your own site. The plugin does not contact any external service and does not require an account.

Application passwords bypass 2FA by design, as that is how WordPress authenticates automated requests. The settings screen documents this, and application passwords can be disabled per role to close that path. The account password itself is refused on XML-RPC and REST for anyone with a second factor, because those requests never reach the challenge.

Passkeys need PHP 8.0 or newer. On older PHP the plugin still runs and offers authenticator apps, backup codes, and email; only the passkey method is hidden.

Yes. The policy is set once for the network under Network Admin → Settings → Sigil, and a user's authenticator or backup codes work on every site because WordPress accounts are network-wide. Passkeys are bound to the domain they were created for, so each site gets its own unless you widen that with the sigil_rp_id filter.

Yes. Put [sigil_2fa] on a page. Users manage their methods from there, and anyone required to enrol is sent to that page rather than to the dashboard.

Yes. Sigil imports from Two Factor (including passkeys from the WebAuthn Provider for Two Factor), Wordfence and WP 2FA. With both plugins active, open Settings → Sigil and choose the import, or run wp sigil import <two-factor|wordfence|wp-2fa> (add --dry-run to preview). Authenticator apps, passkeys, email codes and backup or recovery codes come across, so people keep signing in the way they already do. Anyone with a method that can't be carried over is listed in the report, and the old plugin keeps protecting them while it stays active. The old plugin's data is never changed. Once everyone on that list has set up a method in Sigil, deactivate the old plugin.

Yes. Settings → Sigil lets you pick exactly which roles are required, and set a grace period so people are prompted to enrol rather than locked out immediately.