AZ's WP Passkeys: UX wireframes

Low-fidelity, clickable wireframes of every interface the plugin currently ships. Pick a screen on the left, then use the state chips above each frame to see the variants. Copy matches the plugin's strings. Nothing here talks to a server.

Where each surface lives

Surface	Where	Who
Passkey sign-in	wp-login.php, and the login shortcode or block on any page	Anyone signed out
Passkey setup page	wp-login.php?action=azwp_passkeys_setup, from an emailed setup link	The account owner, signed out
Registration continuation	wp-login.php?action=register, then own profile	New user, single-site only
Passkeys section	Profile and Edit User	Owner, or users who can edit that user
Frontend components	Shortcodes and four blocks	Signed in or out, by component
Site settings	Settings, AZ's WP Passkeys	manage_options
Network settings	Network Admin, Settings	manage_network_options
Logs	Tools, Passkey Logs	manage_options
Activation errors	Plugins screen, on activate or delete	Admins
Notices and email	Admin notices, "passkey added" and "add a passkey" setup emails	Account owners, admins

Core journeys

Open login→Sign in with a passkey→Browser prompt (biometric / PIN)→Verifying→Redirect

Profile→Add passkey→Browser prompt→Saved as “Chrome on Mac”, list refreshes, owner emailed

Admin: Send passkey setup link→Owner opens the email link→Add passkey→Sign-in page: "Passkey added. Sign in with it now."

Register (optional mode)→Signed in at once→Profile, Add passkey focused→Add passkey

Sign-in is always usernameless. The browser picks the account, so there is no username field on the passkey form.

Login page

wp-login.php with a passkey button added to the native login form. Passkey only mode is an on/off switch: off shows the password form and the passkey button, on shows only the passkey button.

/wp-login.php

Click the passkey button to play the ceremony states. With "Remember me" enabled in settings, passkey sign-in follows the form's Remember Me box. Lost-password link disappears when password resets are blocked.

/wp-login.php (Passkey only mode on)

No username, password or lost-password link; resets are closed for everyone in this mode. "Remember me" shows here when enabled in settings. Accounts with no passkey cannot sign in here. Turning the mode on also signs out any session a passkey did not open, on its next page load.

/wp-login.php (no WebAuthn, or not HTTPS)

With Passkey only mode off, the password form works and this message replaces the passkey button. With it on, the message is all that shows.

Passkey prompt cancelled. Try again or use a password.

User dismissed the browser picker. Passkey-only drops "or use a password".

Too many sign-in attempts. Wait a minute and try again.

Rate limit: 30 requests a minute per address.

The passkey could not be verified. Try again.

Any verification failure. The reason is never shown.

Your sign-in session or site settings changed. Start again.

Configuration changed mid-attempt.

Passkeys are unavailable. Contact the site administrator.

Site domain or name not configured.

The result could not be confirmed. Refresh to check.

Network drop after the request was sent.

Could not connect. Check your connection and try again.

Network drop before the request was sent.

The passkey request could not be started. Try again.

The reply that starts the browser prompt was unusable.

This passkey request expired or was already used. Start again.

The attempt expired or was already used.

The request could not be accepted. Refresh the page and try again.

The page's security token is stale.

Password

Sign-in failed. Please try again.

Password sign-in for an account in Passkey only mode while the site-wide mode is off. The form stays, but the password is refused.

Use your passkey for example.com?

Choose an account to sign in with.

alice (iCloud Keychain)

alice-work (Security key)

Verify it's you

Touch ID or enter your device PIN.

( · )

The browser, not the plugin, draws these. Shown here to place the plugin's "Follow your browser's instructions" status.

Registration continuation

Only with "After registration: Sign in and add a passkey" on a single-site install. WordPress still sends its welcome email.

/wp-login.php?action=register

The passkey form is hidden on this screen. The plugin only changes what happens after submit.

/wp-admin/profile.php?azwp_passkeys_registered=1#azwp-passkeys

Your account is ready. Add a passkey so you can sign in next time.

Passkeys

Name	Authenticator	Added	Last used	Actions
No passkeys added.
Name	Authenticator	Added	Last used	Actions

The Add passkey button gets focus (outlined here). One click opens the browser prompt; there is no name to type. If the account leaves without a passkey, it keeps only the sign-in method it had.

Cross-origin post, cookies blocked, or approval plugin denies

WordPress's normal "Registration complete. Please check your email" continuation shows instead. The reason is logged as registration_sign_in with a result such as cross_origin, denied or cookies_suppressed.

Passkeys on Profile and Edit User

Management section added to the profile page. The Passkey only mode checkbox is saved with the normal Update Profile button. Add and Test run immediately.

Passkeys

Passkey only mode

Turn off password sign-in for this account. Make sure you have a working passkey first.

Name	Authenticator	Added	Last used	Actions
MacBook (iCloud) Rename	Apple Passwords Synced	2026-09-02 10:14:22	2026-11-03 08:50:01
YubiKey 5 Rename This passkey is unavailable under the current site settings.	YubiKey 5 NFC	2026-07-11 16:02:13	—
Name	Authenticator	Added	Last used	Actions

Add passkey and Test passkey both go straight to the browser prompt and share one status line; click either to play the states. The "After adding" and "After testing" chips show the results. Remove and Rename open the browser's own prompt and confirm dialogs, see the Dialogs chip.

Passkeys

Name	Authenticator	Added	Last used	Actions
MacBook (iCloud) Rename	Apple Passwords Synced	2026-09-02 10:14:22	2026-11-03 08:50:01
Firefox on Windows Rename	YubiKey 5 NFC	2026-11-04 15:42:57	—
Name	Authenticator	Added	Last used	Actions

Passkey added.

The new passkey appears in the list named after the device and browser that created it, here Firefox on Windows. A second passkey from the same device and browser on this site would be "Firefox on Windows (2)". Use Rename to give it a clearer name. The owner is emailed about the new passkey.

Passkeys

Name	Authenticator	Added	Last used	Actions
MacBook (iCloud) Rename	Apple Passwords Synced	2026-09-02 10:14:22	2026-11-04 16:05:24
Name	Authenticator	Added	Last used	Actions

Passkey test passed for “MacBook (iCloud)”.

Test checks a stored passkey end to end and refreshes "Last used" (highlighted). It does not sign anyone in.

Empty

Name	Authenticator	Added	Last used	Actions
No passkeys added.
Name	Authenticator	Added	Last used	Actions

Loading

Name	Authenticator	Added	Last used	Actions
Loading…
Name	Authenticator	Added	Last used	Actions

Load failed

Name	Authenticator	Added	Last used	Actions
Could not load passkeys. Refresh the page.
Name	Authenticator	Added	Last used	Actions

No permission

Name	Authenticator	Added	Last used	Actions
You do not have permission to manage these passkeys.
Name	Authenticator	Added	Last used	Actions

Result messages

Passkey renamed.

Passkey added.

Passkey test passed for “Chrome on Mac”.

This passkey has already been added. Nothing was replaced.

Add another usable passkey or restore another sign-in method before removing this passkey.

Passkey removed.

Passkey already removed. List refreshed.

The change could not be saved. Try again.

No passkey is available for this account.

Test passkey with no usable passkey.

The email could not be sent. Try again.

Send passkey setup link when mail fails.

You do not have permission to do this.

The operation could not be completed.

Any other server error.

Passkeys

Passkey only mode

Turn off password sign-in for this account. Make sure you have a working passkey first.

Passkey only mode is required by the site or network settings.

Name	Authenticator	Added	Last used	Actions
MacBook (iCloud) Rename	Apple Passwords Synced	2026-09-02 10:14:22	2026-11-03 08:50:01
Name	Authenticator	Added	Last used	Actions

Checkbox is forced on and disabled when the site or network requires it.

Add a working passkey before turning on Passkey only mode for this account.

Passkeys

Passkey only mode

Name	Authenticator	Added	Last used	Actions
No passkeys added.
Name	Authenticator	Added	Last used	Actions

Shown as a profile error after Update Profile when the account has no working passkey. Nothing is saved.

/wp-admin/user-edit.php?user_id=7

Passkeys

Passkeys for Bob Jones

Passkey only mode

Name	Authenticator	Added	Last used	Actions
Bob's phone Rename	Google Password Manager	2026-10-01 09:00:32	—
Name	Authenticator	Added	Last used	Actions

Setup link sent to the account email address. It expires in one hour.

Shown to users with edit_users. Adding a passkey for someone else emails that owner and names the actor. "Send passkey setup link" emails the owner a one-time link; the admin never sees it.

Passkeys are unavailable. Check that this site uses HTTPS and that the server supports OpenSSL, P-256 and SHA-256. HTTP is supported only on localhost.

Passkeys

Passkey only mode

Add is disabled. Test stays enabled so clicking it shows the capability message.

Frontend components

Four shortcodes, each also available as a block. They look like the plugin's own admin pieces but sit inside the theme.

Username or Email Address

Password

Remember Me

or

Attributes: traditional (password form, default on), username (prefill), auto_hide (hide when signed in, default on), to (redirect). The password form uses wp_login_form and is left out when traditional=false or in Passkey only mode, which leaves only the passkey button. Signed-in visitors see nothing while auto_hide is on.

Signed in

Add a passkey for Alice Smith. You can add more than one and rename them later.

Confirm with your fingerprint, face, or device PIN. This is required to continue.

Signed out (display on)

Sign in to manage your passkeys.

With display=false nothing renders for signed-out visitors.

Signed in

Confirm with your fingerprint, face, or device PIN. This is required to continue.

Passkey test passed for “MacBook (iCloud)”.

Signed out

Sign in to manage your passkeys.

Name	Authenticator	Added	Last used	Actions
MacBook (iCloud) Rename	Apple Passwords Synced	2026-09-02 10:14:22	2026-11-03 08:50:01
Name	Authenticator	Added	Last used	Actions

Same table and dialogs as the profile section. Signed-out visitors see "Sign in to manage your passkeys."

Block editor

Four blocks in the Widgets category. The editor shows a placeholder only. Passkey actions never run in the editor.

Passkey sign-in

block, keyword: passkey

Add passkey

Test passkey

Passkey list

Passkey sign-in

Passkey actions are unavailable in the editor.

Passkey sign-in

Include password sign-in form

Prefilled username or email

Hide when signed in

After sign-in, go to

Add passkey / Test passkey / Passkey list

Show a message when signed out

Settings: AZ's WP Passkeys

/wp-admin/options-general.php?page=azwp-passkeys

My SiteHowdy, admin

AZ's WP Passkeys

Website

Website name	The name shown when you use a passkey.
Passkey domain	Use the site's domain or a valid parent domain, without https://, a path or a port.

Sign-in

Passkey only mode	Enable Disable Turns off password sign-in for every account. Sign-in pages show only the passkey button. Make sure each account has a working passkey first. On a network, users need a passkey for each site domain. 3 members have no working passkey for this site and cannot sign in while Passkey only mode is on. View these members
Remember me	Enable Disable Lets passkey sign-in keep people signed in when they tick Remember me. The box starts unchecked.
Block password resets	Both blocking options close public password-reset pages, including for administrators. The administrator exception allows authorized reset operations. Passwords can still be changed in WordPress profiles.
After registration	New accounts are signed in right after registering and asked to add a passkey. WordPress still sends its welcome email, but the email address is not verified before sign-in. This has no effect until Anyone can register is turned on in General settings.

Manage your passkeys | Passkey Logs

Settings saved

Settings could not be saved.

Passkey domain	Check this field and save again.
Passkey only mode	Enable Disable Add a working passkey to your own account before turning on Passkey only mode. Confirm that the accounts listed above will not be able to sign in, then save again.
Passkey domain	Passkey only mode is on, and changing this would stop every passkey from working. Turn Passkey only mode off first.

Passkey domain

Check this field and save again.

Passkey only mode

Enable Disable

Add a working passkey to your own account before turning on Passkey only mode.

Confirm that the accounts listed above will not be able to sign in, then save again.

Passkey domain

Passkey only mode is on, and changing this would stop every passkey from working. Turn Passkey only mode off first.

Browser confirm: 3 accounts have no working passkey and will not be able to sign in. Turn on Passkey only mode anyway? Cancel OK

I understand these accounts cannot sign in.

Without JavaScript this checkbox, inside the readiness notice, replaces the browser confirm.

The domain error also covers IP addresses. The first Passkey only message appears when the saving administrator has no working passkey. The second appears when the confirmation was skipped or the listed accounts changed since the page loaded. The domain message appears when a save would change the Passkey domain or empty the Website name while the mode stays on. Both come back via redirect with status and invalid query args. Cancel in the browser dialog keeps the mode off without saving.

Passkey only mode	Enable Disable
Block password resets	Passkey only mode is on, so password resets are blocked for everyone.

The select keeps its saved value, but Passkey only mode closes resets for everyone while it is on.

Passkeys are unavailable. Check that this site uses HTTPS and that the server supports OpenSSL, P-256 and SHA-256. HTTP is supported only on localhost.

Website name	Enter the website name and passkey domain before adding passkeys.
Passkey only mode	Enable Disable

Passkey only mode	Set in network settings: Disabled Network settings
Remember me	Enable / Disable radios
Block password resets	select

On multisite Passkey only mode is network-owned and shown read-only with this site's readiness count, and After registration is hidden.

Network settings

/wp-admin/network/settings.php?page=azwp-passkeys

Sign-in

Passkey only mode	Enable Disable Turns off password sign-in for every account. Sign-in pages show only the passkey button. Make sure each account has a working passkey first. On a network, users need a passkey for each site domain. 5 accounts have no working passkey on at least one site and cannot sign in there while Passkey only mode is on. Main site: 3 Shop: 2

Only one network-owned control is visible. Turning it on requires the saving super admin to hold a working passkey, and a confirmation while any account lacks one.

Passkey Logs

/wp-admin/tools.php?page=azwp-passkeys-logs under Tools. Newest first, 20 per page. While logging is on, page 1 refreshes every 5 seconds.

Passkey Logs

Logging	Enable Disable Save log entries for troubleshooting. Entries remain until you clear them.

Category Result

45 items of 3

#ID	Event	User	Result	Details	Time	IP address
45	Sign-in: Passkey	marie	✓	Work phone (iCloud Keychain): signed in	November 6, 2026 2:32 pm	203.0.113.24
44	Sign-in: Passkey	—	✗	Sign-in failed: passkey not recognized	November 6, 2026 2:31 pm	198.51.100.7
43	Passkey: Tested	admin	✓	YubiKey 5 (YubiKey 5 NFC): tested for marie	November 6, 2026 2:20 pm	192.0.2.10
42	Passkey: Renamed	marie	✓	Old phone (iCloud Keychain): renamed to Work phone	November 6, 2026 2:14 pm	203.0.113.24
41	Passkey: Deleted	admin	✗	YubiKey 5 (YubiKey 5 NFC) deletion failed for marie: would leave the account without a way to sign in	November 6, 2026 2:10 pm	192.0.2.10
40	Admin: Setup link	admin	✓	Setup link sent to paul	November 6, 2026 1:58 pm	192.0.2.10
39	Settings	admin	✓	Passkey only mode turned on	November 6, 2026 1:40 pm	192.0.2.10
38	Passkey: Account deleted	system	✓	User #7 (paul) deleted with 2 passkeys	November 6, 2026 1:02 pm	—

45 items 1 of 3

Logs remain until cleared. Usernames, passkey names and IP addresses are stored. Passwords and passkey responses are not logged.

Back to settings

Hovering a row shows its correlation ID. Page links keep the filters in the address, so they open the same view in a new tab. An empty User or IP address cell shows —.

Category Result

1 item

#ID	Event	User	Result	Details	Time	IP address
41	Passkey: Deleted	admin	✗	YubiKey 5 (YubiKey 5 NFC) deletion failed for marie: would leave the account without a way to sign in	November 6, 2026 2:10 pm	192.0.2.10

No match

#ID	Event	User	Result	Details	Time	IP address
No log entries match these filters.

Logging off, no entries

Logging	Enable Disable Save log entries for troubleshooting. Entries remain until you clear them.

#ID	Event	User	Result	Details	Time	IP address
No log entries.

After OK

Category Result

1 item

#ID	Event	User	Result	Details	Time	IP address
46	Admin: Logs cleared	admin	✓	45 entries deleted	November 6, 2026 2:40 pm	192.0.2.10

Logs cleared.

Cancel changes nothing. The Logs cleared entry is written even while logging is off.

Check Website name and Passkey domain in settings. The passkey domain must match this site.

#ID	Event	User	Result	Details	Time	IP address
45	Sign-in: Passkey	marie	✓	Work phone (iCloud Keychain): signed in	November 6, 2026 2:32 pm	203.0.113.24

Could not load logs.

A failed load keeps the rows already shown.

Activation and uninstall errors

WordPress error pages shown when the plugin cannot set itself up or clean up. Each one stops the action.

/wp-admin/plugins.php?action=activate

Passkey storage could not be initialized. The database tables must use the InnoDB storage engine.

Shown when a WordPress table uses MyISAM. The plugin saves data in transactions, so it needs InnoDB.

/wp-admin/plugins.php?action=activate

Passkey storage could not be initialized.

Or, when the settings cannot be written: Passkey settings could not be initialized.

/wp-admin/plugins.php?action=activate (on one site of a network)

Activate AZ's WP Passkeys for the network.

On multisite the plugin only network-activates.

/wp-admin/plugins.php?action=delete-selected

Passkey data could not be completely removed. Try deleting the plugin again.

Admin notices and email

Password sign-in is disabled for Alice Smith and no passkey has been added on this site. Add passkey

Passkeys from other sites in this network may still work.

Shown on every admin screen to the owner, and to users with edit_users on that user's Edit screen. The second line only appears on path-based multisite.

Subject: [My Site] Add a passkey to your account Carol Admin sent you a link to add a passkey to your account on My Site. Open it on the device that will store the passkey. It works once and expires in one hour. https://example.com/wp-login.php?action=azwp_passkeys_setup&user=7&token=… If you did not expect this, ignore this email. Nothing changes until the link is used.

After the passkey is added the browser goes to the sign-in page, which says "Passkey added. Sign in with it now." A used, replaced or expired link shows "This passkey setup link has expired or was already used. Ask a site administrator for a new one." The welcome email in Passkey only mode has no set-password link and points to this flow.

Subject: [My Site] Login Details Username: bob Accounts on this site sign in with passkeys only, so there is no password to set. Ask a site administrator to send you a passkey setup link. https://example.com/wp-login.php

WordPress sends this to a new account while Passkey only mode is on, from public registration or Add New User. It replaces WordPress's set-password text, so it has no reset link. With the mode off, WordPress's normal welcome email is unchanged.

Subject: [My Site] A passkey was added to your account A passkey from Apple Passwords (named “Safari on iPhone”) was added to your account on My Site. (or: A passkey from an unknown authenticator (named “Passkey”) was added to your account on My Site.) It was added while you were signed in. (or: It was added by Carol Admin.) (or: It was added with a setup link sent by Carol Admin.) If you did not expect this, remove the passkey and change your password: (or, in Passkey only mode or without password sign-in: If you did not expect this, remove the passkey and tell a site administrator:) https://example.com/wp-admin/profile.php#azwp-passkeys

Sent in the owner's locale after every confirmed registration. A mail failure never affects the result.

AZ's WP Passkeys

Settings | Deactivate