What Are Passkeys? A Simple Guide for WordPress and WooCommerce Site Owners

If you run a WordPress website or WooCommerce store, you may have already encountered something called passkeys. There are the increasingly common prompts that appear when signing into various online platforms encouraging you to create a passkey as an alternative to a traditional password.

While these prompts can sometimes feel annoying, passkeys are becoming the future of online security. Google now requires them for certain sensitive actions in Google Merchant Center and Google Ads entirely, meaning you might encounter passkeys whether you have chosen to adopt them or not.

So What Is a Passkey?

A password is like a secret phrase you have to remember. A passkey is more like the key to your car.

The phrase only works if you can recall it and anyone who hears it can use it. Someone can trick you into saying it out loud or find it written on a sticky note. A car key is different. You do not memorize anything you just carry it and it only fits your car, nobody else’s.

How a Passkey Works

When you create a passkey, your device makes two matching halves of a key for that one website. The website keeps one half. Your device keeps the other and never sends it to the website. The website’s half can only check a sign-in. It cannot be used to sign in so it is no use to a thief.

When you sign in, the website asks your device to prove it holds the matching half. Your device first asks for your face, fingerprint, or PIN then answers.

That confirmation happens on your device. Google says your biometric data “stays on your device and is never shared with Google.” If you use your face to create a passkey, it is not being sent to the website, it is only unlocking the key you already hold to access the website.

Why Passkeys Are Growing So Quickly

Passkeys are now becoming more mainstream. The FIDO Alliance estimates that 5 billion passkeys are in use worldwide. In an April 2026 Sapio Research survey of 11,000 consumers in 10 countries, 75% said they had enabled a passkey on at least one account. In the same survey, 49% said they use passkeys regularly when available. Some platforms even now require them.

Google Merchant Center and Google Ads passkey requirement

One of those pushing heavily for this is Google. Google Merchant Center now requires a passkey to confirm your identity for sensitive actions including website or URL changes and admin or user management. Google says this is rolling out gradually to all Merchant Center users. Google Ads made a similar move first. PPC Land reported in May 2026 that a Google passkey would be required from July 15th, 2026 for certain sensitive actions, such as account linking updates and user access changes.

In reality, the prompt seems to be appearing for most users even sooner than that. We have seen many clients now who were blocked at sign-in while reconnecting Merchant Center to WooCommerce and Shopify. We know this can be frustrating when you discover this requirement, especially if your Google Shopping feed or Google Ads need attention and you have no idea what a passkey is or how to set it up (which is why we made this guide!).

Why Passkeys Are More Secure Than Passwords

Before we dive into how to implement a passkey (which I promise isn’t as hard as it seems), let’s get your buy-in on why passkeys are actually better security-wise. On an account that uses only a passkey, there is no secret to type, reuse, or be tricked into giving away. Under the web standard behind passkeys, a passkey can only be used by the website it was created for. A fake login page on a lookalike domain has nothing to ask your device for. That matters for site owners such as yourself because phishing emails can pose as your web agency or host. With passkeys, you can’t accidentally add your passkey to a fake website or fake login and have your account stolen since your passkey is tied solely to the official website where you added the passkey. Go back to the car key. You cannot read a key to a scammer over the phone. It also will not open a lookalike car parked down the street because it only fits the one it was made for. It’s the same with websites and passkeys.

The other huge benefit of passkeys is if a website gets hacked, at most they only have half your key, the side the website keeps. If a hacker got into a website you frequent, at best they could get that key, they still wouldn’t have your own device key which means they couldn’t impersonate you. Plus since each key is only relevant for one website, it isn’t like a password leak dump where you might have accidentally used the same password on multiple sites and now hackers and bots try to use that leaked password on other sites to steal your identity or login to your other online accounts.

	Password	Passkey
What you do	Remember or look up a phrase	Confirm with your face, fingerprint, or PIN
Fake login pages	Can be typed into a fake site	Only works on the real site
Website data breach	Stolen password data may be cracked and reused	The site only holds a public key, which cannot sign you in
Reuse across sites	Common, and one leak can open many accounts	Impossible, each site gets its own passkey
Weak choices	Easy to pick something guessable	Always strong, there is nothing to choose

Note all of this assumes the password is no longer in use :) Many accounts keep the password as a backup after you add a passkey and a fake login page can still ask for it. Keep that password strong and unique and leave two-factor authentication switched on. Hopefully in the future, the password backup will not be needed to close that gap.

Now the Fun Part: Passkeys Are Actually Easier Than Passwords :)

A passkey takes steps out of signing in. Setup is a short series of prompts on your device and after that signing in is usually a single glance or touch. There is no password to recall, no code to wait for and no reset email to dig out of spam.

We saw this firsthand recently. A WooCommerce client of ours urgently needed to reconnect Google Merchant Center to their store and Google blocked the sign-in until they used a passkey. They were able to use iCloud with Face ID and they saw how easy it can be. Even with our own e-commerce agency, we have found using passkeys is saving our team time compared to dealing with passwords.

The FIDO Alliance’s 2026 Passkey Index found that signing in with a passkey is nearly three times faster than signing in without one, saving an average of 27 seconds of your life!

Can You Use a Passkey on More Than One Device?

The big question often is do I need separate passkeys for every device? What if I lose one of my devices, am I locked out of my account?? The good news is this is a resounding no as long as the passkey is saved in a pass manager that syncs. While passkeys are traditionally tied to a single device such as a hardware security key (a small USB key), this is not the only way to use passkeys.

Instead, you can use a platform that offers synced passkeys. In fact, you might already be using one of these for storing passwords, see below:

• Apple iCloud Keychain: Passkeys sync across your Apple devices with end-to-end encryption, plus you can unblock with Face ID.
• Google Password Manager: Saved passkeys are available on your devices signed in to the same Google account.
• 1Password: Passkeys sync across Mac, iOS, Windows, and Android, which helps if your household or team mixes platforms.

Now if you are on a computer without your passkey or password manager, you are usually not stuck. Many sites will show a QR code you can scan with your phone and pull the passkey from your password manager on your phone. One thing to keep in mind is syncing does mean your password manager account becomes very, very important. Protect it well and make sure you have all the safety precautions enabled in your password manager (with a strong master password!). If a login belongs to the business, save its passkey in an account the business controls, such as a company password manager, ie. 1Password, Bitwarden, LastPass, etc. A passkey saved in an employee’s personal iCloud or Google account won’t stay with the company otherwise and can’t be used by other employees.

How to Set Up a Passkey

Let’s start with your Google account because that is where a passkey is most likely to become required. The passkey belongs to your Google account rather than one Google product so the same passkey should work for both Merchant Center and Google Ads (among other Google services tied to your Gmail or Google Workspace account).

1. First, make sure you enable a screen lock on your device for best security practices. Make sure your device is protected with Face ID, Touch ID, a PIN or another supported screen lock. This is also important if you use a password manager such as 1Password or LastPass.
2. Open your Google Account security settings. Navigate to your Google Account settings and select Passkeys and security keys.
3. Create and save your passkey. Click Create a passkey and follow the on-screen instructions. Pay close attention to where your passkey is saved, especially if you use a password manager. For example on my Mac, the default option is often to save the passkey to my personal iCloud Keychain. However for business accounts, I prefer to store passkeys in our company’s 1Password. To do this, I need to select the 1Password save passkey prompt that appears on the right side of my browser instead of accepting Apple’s default option which pop-ups up in the middle of the screen.This step can be a little confusing, but it’s important to ensure your passkey is stored in the password manager you intend to use.
4. Check your other work devices. If you use multiple devices for work, confirm that your passkey is available on each one. If your password manager securely syncs passkeys across devices, you generally won’t need to create a separate passkey for each device.

Once you are comfortable with setting up passkeys, work through the other accounts your business depends on and turn on passkeys wherever they are offered such as:

• Business email
• Domain registrar and DNS
• Website hosting
• Payment gateways such as Stripe and PayPal
• Your password manager, but first save its recovery code or emergency kit somewhere safe, since losing access could lock you out of everything at once

Passkeys for WordPress

WordPress does not support passkeys on its own so adding them to your login takes a plugin. With that said, there are a few free options available below:

Plugin	Cost	Active installs	Worth knowing
Secure Passkeys	Free	2,000+	Supports passwordless login and WooCommerce login pages.
Wordfence Security	Free; premium upgrades available	5 million+	Passkeys are included in the free version with WooCommerce integration and 2FA support.

There are also several paid security plugins that support passkeys including two of the most common:

Plugin	Cost	Active installs	Worth knowing
WP 2FA Premium	From $79/year for 1 site	100,000+*	Passwordless passkeys, multiple passkeys per user, and WooCommerce integration.
Kadence Security Pro	Bundled; current Kadence package starts at $350/year for 1 site	700,000+*	Supports passkey authentication; Pro licensing is bundled rather than sold separately.

One thing to remember is that a passkey does not automatically replace two-factor authentication on your site because the password login usually still exists alongside it. You should 100% be using 2FA even with passkeys!

On the Inspry managed support side of WordPress logins, we will communicate enforcement of passkeys in the future if that becomes required. For now, keep using two-factor authentication as you do today and talk to us before installing a passkey plugin. None of this stops you from using passkeys on your other accounts such as Google.

Passkeys for WooCommerce Stores

For WooCommerce, the first priority is everyone with backend access: administrators and shop managers. Those accounts can change payment settings, view customer data, and edit checkout so they gain the most from stronger logins, whether that means a passkey or two-factor authentication.

Customer passkeys are a separate decision. They can make repeat purchases smoother and they spare customers another password to manage. Options include the Biometric Passkey Login extension, listed at $39 per year which adds a passkey button to the My Account login form and the classic checkout login prompt. Plus some of the free and paid plugins noted above support WooCommerce logins if this is something you want to consider for your WooCommerce customers. If you offer customer passkeys, treat them as an extra choice and keep your other options available.

Passkey FAQ

Do passkeys replace passwords?

On some accounts they can, but many sites keep a password as a fallback. Until that option is removed, a strong unique password still matters. Note if you do plan to not keep a password backup, we recommend having a secondary passkey so you don’t get fully locked out.

Is a passkey safer than two-factor authentication?

Against phishing, generally yes, because there is no code to hand over and the passkey only works on the real site. On WordPress, keep two-factor authentication on too since the password route often remains open.

Does Google Merchant Center require a passkey to log in?

Google’s help page ties the requirement to sensitive actions such as website or URL changes and user management. Even so, we have seen a client blocked at sign-in while reconnecting Merchant Center to WooCommerce. If Merchant Center stops you with a passkey prompt at any point, creating a passkey is the way through.

What happens if I lose my phone?

If your passkey is synced, it is still on your other devices signed in to the same iCloud, Google, or 1Password account and it comes back on a replacement phone once you sign in there. Lock or erase the lost phone remotely and remove it from that account. Do not delete the passkey itself from the website unless you have another way to sign in because deleting a synced passkey removes it on every device. If the passkey lived only on the lost phone, sign in with your spare passkey or recovery method, then remove the lost one in your account settings. If you cannot get into a Google account at all, Google’s guidance is to contact Google Support or your internal IT administrator.

Does the website get my fingerprint or face scan?

No. Your face or fingerprint only unlocks the passkey on your device. The website receives a cryptographic signature instead simply authenticating you can access the website.

Does WordPress support passkeys without a plugin?

If I add passkeys to my WordPress or Woo site and move to a new domain, will passkeys still work?

No, a passkey belongs to one web address so passkeys for your WordPress login stop working if the site moves to a new domain and they will not work on a staging site at a different address. Before a move, check that every user can still sign in with a password and two-factor authentication then create new passkeys at the new address.

Start With One Account Today

The easiest first step is creating a passkey for the Google account you use for your business. Do it before you need it so that a Merchant Center or Google Ads change will not catch you off guard later.

Inspry helps businesses keep their WordPress and WooCommerce sites secure, from logins and user access to plugins, checkout, and monitoring. If you are a current client and want help getting your team set up, reach out anytime and we can assist you through your retainer plan.

Not sure where your store stands? Our WooCommerce website audits review your security configuration, plugins, custom code, and performance, then give you a prioritized list of what to fix first.

Request a WooCommerce Site Health Audit