Enable WordPress Biometric Login Using iThemes Security Pro

WordPress is straightforward to use and easy to hack, too. Every year, millions of websites are hacked despite implementing the most secure security protocols.

I can’t blame WordPress, as the software has limitations. Traditional security methods like strong passwords and two-factor authentication are outdated now.

So, what is the solution? Leave our websites open to getting hacked?

This may not be the ideal approach as you spend your time and money building a website. A hack can completely spoil the effort.

How about WordPress Passwordless Login or, more specifically, the WordPress Biometric Login?

I believe you are hearing about WordPress Biometric login for the first time. But it sounds interesting. Isn’t it? Let’s dig into it in this article.

WordPress Passwordless login is a feature. Why?

We need to understand how hackers bypass traditional security measures such as strong passwords and two-factor authentication.

Hackers can use phishing to steal your password, hack your browser to steal it, or even steal it if your server stores it. There are thousands of ways hackers can hack your website.

However, WordPress Passwordless Login uses biometric security, which is practically impossible to hack, as it is tough to steal your biometric information. That is why most banks use biometric authentication nowadays.

iThemes Security Pro is one of the few WordPress security plugins offering WordPress Biometric Login. We will learn more about this technology in this article.

What Is WordPress Passwordless Login?

Passwordless login means you don’t need a password to access your WordPress dashboard. Traditional security methods require you to enter your password every time you log in to WordPress.

The issue with traditional security methods is that passwords are saved in your database, which is easy to hack. That is why WordPress Passwordless Login comes to the rescue.

There are two different methods of WordPress Passwordless Login.

• Using Magic Links
• Using Passkeys

Magic Link

Magic Link sends an email with a link when you enter your username. You don’t need to enter the password to get the magic link.

When you click on the magic link, you can log in automatically.

However, with the magic link, you need to check your email to click the link. That is time-consuming; anyone can hack your emails to break this security system.

Passkeys

For passkeys, WordPress will ask for them every time you log in, rather than sending an email. Passkeys are device-specific and not stored on the server. So, there is less chance of getting tempered.

The passkey can be a numeric code (as on a Windows Computer without Windows Hello) or your face ID / Touch ID (on an iPhone, Android Phone, or Mac).

Passkeys make the login process easier on mobile devices, as you can use phone authentication to log in to WordPress.

You need to protect your phone’s biometric information rather than protecting passwords, emails, or two-factor authentication apps.

Passkeys are supported by WebAuthn, a cryptographic authentication protocol that uses a public-private key pair.

The development of WebAuthn has involved representatives from tech giants such as Google, Microsoft, and Mozilla. That shows the kind of security protocol WebAuthn uses.

What Is WordPress Biometric Login

WordPress Biometric Login is a WordPress Passwordless Login where you will use your biometric information to log in to the WordPress dashboard.

Biometric information like FaceID and TouchID is more secure than passkeys, as it is harder to steal.

How To Configure Passkeys Or WordPress Biometric Login?

iThemes Security is the best plugin for enabling Biometric Login on your WordPress website. However, you need the pro version to enable this feature.

Once you have installed the Pro version, you need to enable passkey and passwordless login under Security-> Settings -> Login Security.

You may select only the “passwordless login” option if you want a magic link sent to your email ID whenever you try logging in.

Next, please go to the “Passwordless Login” settings page and check the “Passkey” option.

Security > Settings > Configure > Login Security > Passwordless Login

Once done, click on the “Save” button. That will enable the “Passwordless Login” for all users.

Next, when you try to log in with your user ID and password, you will be asked to set up the passkey as shown below.

To set up passkeys now, click “Use Your Passkeys.“

Click on “Add A Passkey” to register your device. A pop-up will appear, and you must follow the instructions onscreen. The instructions will vary based on the device you use.

For example, the following pop-up will appear if you try to set passkeys on an Apple product with Touch ID.

On Android or iPhone, similar instructions will appear based on the authentication feature you have on your phone.

You may skip the setup and use the password as long as you want. If you want to set up a passkey later, you can go to the user profile page and click “Setup Passkeys.“

How To Log In From Devices That Are Not Configured?

As you already understand, the Passkeys are device-specific and not stored on the server. You are using your device authentication to log in to WordPress.

But how about logging in to WordPress from a device that is not configured?

In that case, you can use a QR code-based sign-in.

When you try to log in with your user ID and Password, the system will display a prompt with options to sign in.

You can select the desired option and scan the QR code to enter the WordPress admin area. Later, if you try to log in again from the same device, you can use the same authentication method you already configured.

Conclusion: WordPress Biometric Login

Biometric login is the future. Because it is one of the most secure authentication methods. Passwords are easy to hack and steal, but it is next to impossible to steal your biometrics.

Passkeys are not stored on the server and are device-specific. That makes the hacker’s job much harder.

iTheme Security Pro is one of the best plugins that offers a WordPress Biometric Login using passkeys. I highly recommend upgrading to the pro version to avoid missing this vital security feature.

FAQ | WordPress Biometric Login