Wordfence 9 adds passkey login, free for all users

Wordfence announced on 15 September 2026, via its official blog, support for passkeys in version 9 of the WordPress security plugin. For anyone administering WordPress sites on their own servers or client deployments, this development addresses a recurring pain point: the volume of support tickets related to forgotten or lost passwords.

What changes for login

According to Wordfence, passkeys enable users to authenticate without having to remember a password or retrieve it from a password manager and paste it into the login form. The mechanism is based on the passkey standard, already adopted by modern operating systems and browsers to replace passwords with device-bound credentials.

Wordfence describes this integration as "friction reduction" for the end user—an aspect that impacts both security (fewer weak or reused passwords) and login experience, particularly on sites with restricted areas or e-commerce platforms where login abandonment is a real problem.

What's still missing from the announcement

Wordfence's statement does not currently provide, at the time of publication, technical details on minimum PHP or WordPress requirements, compatibility with other two-factor authentication plugins, or guidance on how existing users with traditional passwords migrate. No figures are given on adoption rates or server-side compatibility testing.

What to verify before enabling it

Anyone managing multiple WordPress installations should check, before rolling out to production sites:

• the minimum Wordfence version required for passkeys (Wordfence 9);
• whether HTTPS must be active across the entire domain, a typical requirement for WebAuthn/passkey implementations;
• compatibility with custom login plugins or SSO systems already in use on client sites.

For complete technical details and configuration documentation, refer to the official Wordfence blog, the source of the announcement.