Sigil – Passkeys and Two-Factor Authentication

Sigil adds a second authentication step to WordPress logins. Users enrol a passkey, an authenticator app, backup codes or email codes from their profile, and administrators can require 2FA for chosen roles with a grace period.

Methods

• Passkeys (WebAuthn), using a platform authenticator such as Face ID, Touch ID or Windows Hello, or a hardware security key. Requires PHP 8.0 or newer.
• Authenticator app (TOTP), compatible with any RFC 6238 application.
• Backup codes: ten single-use codes, generated the first time any method is set up.
• Email codes: a six-digit code sent to the account email address.

Enforcement

• Require 2FA per role, or for everyone with a chosen capability.
• Set a grace period so existing users get time to enrol instead of being locked out on the next login.
• A “2FA” column on the Users screen shows who has set it up and who has not.

Recovery

Three ways back in if a second factor is lost:

• Backup codes are generated and displayed at first enrolment.
• A user with the edit_users capability can reset another user’s 2FA from the Users screen.
• wp sigil reset <user> clears a user’s second factor from the command line when no one can reach the dashboard.

Application passwords

Two-factor authentication does not apply to application passwords, which authenticate REST API and XML-RPC requests. The settings screen documents this, and application passwords can be disabled per role.