Passkeys for Business Websites and Admin Logins: A Guide

Passkeys for business websites have moved from "nice to have" to the recommended default. In April 2026 the UK's National Cyber Security Centre (NCSC) said passkeys should be consumers' first choice of login and can be recommended to businesses "as the default authentication option to offer consumers". This guide explains what a passkey is, why it stops phishing where passwords and codes fail, where you can turn passkeys on today for your admin accounts and website, and how to roll them out without locking anyone out.

Key takeaways

Passkeys stop phishing because the signature is tied to the real website address, so a fake login page has nothing to capture or relay.
In April 2026 the NCSC said passkeys can be recommended to businesses as the default authentication option to offer consumers.
Turn on passkeys first for email, hosting, registrar, website admin and shop accounts, registering two credentials and keeping recovery codes offline.
WordPress core has no passkey login as of October 2026, so use a plugin such as Two Factor with its WebAuthn provider add-on.

What is a passkey?

A passkey is a login credential based on public-key cryptography, built on the FIDO2 standards from the FIDO Alliance and the W3C's Web Authentication API (WebAuthn). Instead of typing a secret, you unlock the passkey on your device with your fingerprint, face or device PIN.

Under the hood, MDN describes it like this:

Registration. Your device creates a key pair for that one website. The site stores the public key. The private key stays on your device or in your password manager.
Sign-in. The site sends a random challenge. Your device signs it with the private key after you unlock it. The site checks the signature with the public key.

The site never holds anything an attacker can reuse. MDN notes that if an attacker gets the public key, "it can't authenticate because it needs the private key". A database breach does not leak passwords, because there are none.

Synced and device-bound passkeys

Type	Where it lives	Good for
Synced passkey	Apple Passwords, Google Password Manager, Microsoft or a third-party password manager, synced across your devices	Most staff and customers; survives a lost phone
Device-bound passkey	A single device or a hardware security key	High-privilege admin accounts where you want the credential to stay on one physical key

Shopify, for example, labels each passkey as synced or device-only in your account settings, so you can see which kind you have created.

How passkeys stop phishing

Most account takeovers start with a convincing fake login page. A password typed into that page is captured. A six-digit code from an authenticator app or SMS can be relayed to the real site within seconds. The NCSC describes these traditional methods as "inherently phishable".

Passkeys are different because the signature is tied to the website's real address. MDN puts it simply: "An attacker who creates a fake login website can't login as the user because the signature changes with the origin of the website." The browser will only offer the passkey for yourbusiness.com on yourbusiness.com. On yourbusiness-login.com there is nothing to offer, so there is nothing for the user to hand over, however convincing the page looks.

The NCSC says passkeys "are highly resistant to phishing attacks and cannot be intercepted, reused or guessed like passwords can", and its technical report found them at least as secure as the strongest password combined with two-step verification.

Do passkeys work better for users?

The FIDO Alliance's Passkey Index, published in October 2025 with data from companies including Amazon, Google, Microsoft, PayPal and TikTok, found:

93% of accounts at participating services were eligible for passkeys.
36% of accounts had a passkey enrolled, and 26% of sign-ins used one.
Passkey sign-ins had a 93% success rate, against 63% for other methods.
Passkeys cut sign-in time by 73%, to an average of 8.5 seconds.

Fewer failed logins means fewer password resets and support calls, which matters for a small team as much as a large one.

Where to turn on passkeys for your business accounts

Start with the accounts that control everything else: email, hosting, domain registrar, website admin and your online shop.

Google accounts and Google Workspace

Personal Google accounts can create a passkey at g.co/passkeys. In Google Workspace, users can always add a passkey as a two-step verification method, but signing in without a password must be enabled by an administrator. In the Admin console, go to Security > Authentication > Passwordless and allow users to skip passwords at sign-in by using passkeys. Google says the setting is off by default.

Microsoft accounts and Microsoft 365

For Microsoft 365 business tenants, passkeys are controlled in Microsoft Entra ID:

Sign in to the Entra admin centre with at least the Authentication Policy Administrator role.
Go to Entra ID > Security > Authentication methods > Policies and open Passkey (FIDO2).
Enable it for a pilot group first, and make sure Allow self-service set up is set to Yes.
Decide whether to allow synced passkeys or only device-bound ones such as Microsoft Authenticator and hardware keys.
Ask users to register at aka.ms/MySecurityInfo.

Microsoft says passkeys are included in every Entra ID edition, including Free, with no extra licences. Registration requires the user to have completed MFA in the previous five minutes.

WordPress

WordPress core does not include passkey login as of October 2026, so you need a plugin. The common route is the Two Factor plugin plus the WebAuthn Provider for Two Factor add-on, which supports passkeys, Windows Hello, Touch ID and hardware security keys. There are also standalone passkey plugins that add a "sign in with passkey" button to the login page and let you choose which user roles can use it.

Install and test the plugin on a staging copy first.
Register a passkey for your own administrator account and log out and back in.
Keep backup codes or a second passkey registered before you enforce anything.
Roll it out to other administrators and editors, then check their profiles.

Our guide to two-factor authentication for your website admin covers the Two Factor plugin set-up in detail, and the WordPress security checklist lists the other settings to tighten.

Shopify

Shopify admin accounts support passkeys. From the Shopify admin, open your profile, choose Manage account, go to Security and select Create a passkey. You can then sign in with the passkey icon on the login page, or use a passkey from a nearby phone. Save your recovery codes somewhere safe before relying on it.

Hosting, cPanel and registrars

Support varies between providers. Check your hosting customer account, registrar and DNS provider (Cloudflare included) for passkey or security-key options under their security settings. Where passkeys are not offered, use an authenticator app rather than SMS.

Should you offer passkeys to customers?

If your site has customer accounts, such as an online shop, booking system or client portal, adding passkey sign-in is worth considering:

On a hosted platform (Shopify, Wix, Squarespace), customer login is controlled by the platform. Check its current options rather than building your own.
On WordPress or WooCommerce, a passkey plugin can cover customers as well as staff, but test the checkout and account flows carefully.
On a custom site, ask your developer to use a maintained WebAuthn library rather than writing the cryptography by hand. WebAuthn only works over HTTPS, so check your certificate with our SSL checker (free account required) first.

Make passkeys optional for customers at first, keep a fallback, and promote passkeys at the moment people sign in. The NCSC also points out that replacing SMS codes can save money, since text messages cost providers on every login.

A rollout plan for a small team

List your critical accounts: email, domain registrar, DNS, hosting, website admin, shop, payments, accounting.
Turn on passkeys for yourself first on each, and register two credentials where possible, for example your phone and a hardware key, or synced passkeys in two different password managers.
Keep recovery codes offline, in a password manager or printed in a safe place.
Pilot with one or two colleagues who will report problems honestly.
Remove weaker methods once passkeys work. Leaving SMS as a fallback keeps a phishable path open. Keep at least one recovery method that is not a phone number.
Write a leaver process. When someone leaves, remove their passkeys and sessions on every service, not just their password.
Review every six months. New services add passkey support regularly.

Passkeys protect the login. They do not fix out-of-date plugins, weak security headers or an exposed admin panel. Run a free website audit to check your site's TLS, security headers and other basics alongside your login changes.

Frequently asked questions

Are passkeys more secure than two-factor authentication?

For phishing, yes. Passkeys are tied to the real website's address, so a fake login page cannot capture or relay them, whereas passwords and one-time codes can be stolen that way. The NCSC found passkeys at least as secure as the strongest password combined with two-step verification.

What happens if I lose the phone that holds my passkey?

If your passkeys are synced through Apple, Google, Microsoft or a password manager, they are restored when you sign in on a new device. Device-bound passkeys are lost with the device, which is why you should register at least two credentials and keep recovery codes for every critical account.

Does WordPress support passkeys?

Not in core as of October 2026. You can add passkeys with a plugin, such as the Two Factor plugin with its WebAuthn provider add-on, or a dedicated passkey login plugin. Test it on staging and keep backup codes before enforcing it.

Can staff share a passkey for a shared admin account?

They should not. Each person should have their own named account with their own passkeys, so you can see who did what and remove access cleanly when someone leaves. Shared logins are a common route for attackers and make audits impossible.

Is a passkey the same as a hardware security key?

A hardware security key is one place a passkey can live. Passkeys can also be stored on phones, laptops and in password managers. All use the same FIDO2 and WebAuthn standards, so a site that supports passkeys usually accepts security keys too.

Passkeys for Business Websites and Admin Logins: A Guide