Title: Sigil – Passkeys and Two-Factor Authentication
Author: Jean Galea
Published: August 2, 2026
Last modified: August 2, 2026
---
Search plugins
# Sigil – Passkeys and Two-Factor Authentication
By [Jean Galea](https://profiles.wordpress.org/jeangalea/)
[Download](https://downloads.wordpress.org/plugin/sigil-2fa.0.1.2.zip)
* [Details](https://wordpress.org/plugins/sigil-2fa/#description)
* [Reviews](https://wordpress.org/plugins/sigil-2fa/#reviews)
* [Installation](https://wordpress.org/plugins/sigil-2fa/#installation)
* [Development](https://wordpress.org/plugins/sigil-2fa/#developers)
[Support](https://wordpress.org/support/plugin/sigil-2fa/)
## Description
Sigil adds a second authentication step to WordPress logins. Users enrol a passkey,
an authenticator app, backup codes or email codes from their profile, and administrators
can require 2FA for chosen roles with a grace period.
**Methods**
* Passkeys (WebAuthn), using a platform authenticator such as Face ID, Touch ID
or Windows Hello, or a hardware security key. Requires PHP 8.0 or newer.
* Authenticator app (TOTP), compatible with any RFC 6238 application.
* Backup codes: ten single-use codes, generated the first time any method is set
up.
* Email codes: a six-digit code sent to the account email address.
**Enforcement**
* Require 2FA per role, or for everyone with a chosen capability.
* Set a grace period so existing users get time to enrol instead of being locked
out on the next login.
* A “2FA” column on the Users screen shows who has set it up and who has not.
**Recovery**
Three ways back in if a second factor is lost:
* Backup codes are generated and displayed at first enrolment.
* A user with the `edit_users` capability can reset another user’s 2FA from the
Users screen.
* `wp sigil reset ` clears a user’s second factor from the command line when
no one can reach the dashboard.
**Application passwords**
Two-factor authentication does not apply to application passwords, which authenticate
REST API and XML-RPC requests. The settings screen documents this, and application
passwords can be disabled per role.
## Installation
1. Install through Plugins Add New and search for “Sigil”, or upload the plugin files
to `/wp-content/plugins/sigil-2fa/`.
2. Activate it through the Plugins menu.
3. Go to Users Two-Factor Setup and enrol your first method. Save the backup codes
it shows you.
4. To require 2FA for other users, open Settings Sigil and choose the roles and grace
period.
## FAQ
### What happens if I lose my phone and get locked out?
Use one of the backup codes shown when you first set up 2FA. If you did not keep
those, another administrator can reset your account from the Users screen. If nobody
can get in at all, anyone with server access runs `wp sigil reset ` and your second factor is cleared.
### Does the plugin require an external account or service?
No. All authentication happens on your own site. The plugin does not contact any
external service and does not require an account.
### Does this work with application passwords, the REST API, and XML-RPC?
Application passwords bypass 2FA by design, as that is how WordPress authenticates
automated requests. The settings screen documents this, and application passwords
can be disabled per role to close that path.
### Which PHP version do I need for passkeys?
Passkeys need PHP 8.0 or newer. On older PHP the plugin still runs and offers authenticator
apps, backup codes, and email; only the passkey method is hidden.
### Can I enforce 2FA only for administrators?
Yes. Settings Sigil lets you pick exactly which roles are required, and set a grace
period so people are prompted to enrol rather than locked out immediately.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“Sigil – Passkeys and Two-Factor Authentication” is open source software. The following
people have contributed to this plugin.
Contributors
* [ Jean Galea ](https://profiles.wordpress.org/jeangalea/)
[Translate “Sigil – Passkeys and Two-Factor Authentication” into your language.](https://translate.wordpress.org/projects/wp-plugins/sigil-2fa)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/sigil-2fa/), check
out the [SVN repository](https://plugins.svn.wordpress.org/sigil-2fa/), or subscribe
to the [development log](https://plugins.trac.wordpress.org/log/sigil-2fa/) by [RSS](https://plugins.trac.wordpress.org/log/sigil-2fa/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 0.1.2
* Author attribution updated to Jean Galea.
#### 0.1.1
* Renamed the plugin to Sigil. The text domain is now `sigil-2fa` and the WP-CLI
command is `wp sigil`.
* Translations are no longer bundled; they come from translate.wordpress.org.
#### 0.1.0
* First release: passkeys, authenticator apps, backup codes, and email codes.
* Per-role enforcement with a configurable grace period.
* Lockout recovery: backup codes, admin reset, and a WP-CLI reset command.
* Per-role application-password control.
## Meta
* Version **0.1.2**
* Last updated **1 day ago**
* Active installations **Fewer than 10**
* WordPress version ** 6.9 or higher **
* Tested up to **7.0.2**
* PHP version ** 7.4 or higher **
* Tags
* [2FA](https://wordpress.org/plugins/tags/2fa/)[authentication](https://wordpress.org/plugins/tags/authentication/)
[passkeys](https://wordpress.org/plugins/tags/passkeys/)[security](https://wordpress.org/plugins/tags/security/)
[two factor](https://wordpress.org/plugins/tags/two-factor/)
* [Advanced View](https://wordpress.org/plugins/sigil-2fa/advanced/)
## Ratings
No reviews have been submitted yet.
[Your review](https://wordpress.org/support/plugin/sigil-2fa/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/sigil-2fa/reviews/)
## Contributors
* [ Jean Galea ](https://profiles.wordpress.org/jeangalea/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/sigil-2fa/)