AlphaLogin | Passkeys, 2FA & SSO for WordPress
Passkeys, two-factor codes, magic links and SSO through your Alpha accounts portal, with brute-force protection, session control, login designer and audit log.
Highlights
All 12 features →AlphaLogin | Passkeys, 2FA, SSO & Login Security for WordPress
AlphaLogin replaces the password-only front door of WordPress. Users sign in with a passkey, an authenticator code, an email link, or once through your Alpha accounts portal for every site you connect. Behind that, a brute-force guard, session control and an audit log show you what happens on wp-login, and a designer makes the page look like yours.
Key Features
- Passkeys (WebAuthn): sign in with a fingerprint, face or security key, without typing a username
- Two-factor codes (TOTP) with QR setup, 10 recovery codes, required for the roles you choose
- Single sign-on through the Alpha accounts portal: sign in once, land in every connected site; auto-create users with a domain-to-role map
- Email magic links, single use
- Brute-force guard: per-IP and per-user lockouts with escalation, an allow-list, generic error messages, XML-RPC off
- Login page designer: colours, logo, background and custom CSS with a live preview
- Sessions: every device holding a session for an account, sign out any of them
- Profile section for users: their passkeys, 2FA and sessions
- Audit log of sign-ins, failures, lockouts and changes, with CSV export and retention
- Users overview: who has which factor
- Emergency kill switch file that turns 2FA off
[alphalogin_button]shortcode for a portal sign-in button anywhere
Single Sign-On
Register the site as an app in your Alpha accounts portal (the one AlphaPanel ships), paste the app id and secret, and the login page gets a "Continue with Alpha" button. The sign-in runs on the portal (popup or redirect), AlphaLogin confirms the assertion server-to-server, and the user is signed into WordPress; new users can be created automatically with a role chosen by email domain.
Shortcodes & Hooks
[alphalogin_button]: portal sign-in button- Filters for the avatar, the role map and the redirect after sign-in
Installation
- Download the zip from your Library
- In wp-admin go to Plugins › Add New › Upload Plugin, choose the zip and activate it
- A new menu entry appears in the admin sidebar; open it
- AlphaLogin › Passkeys & 2FA: turn on what you want; SSO: paste the portal app credentials and press Test
Requirements
- WordPress 6.0 or newer (tested up to 7.0)
- PHP 8.0 or newer
- HTTPS (passkeys need a secure origin)
- For SSO: an Alpha accounts portal (AlphaPanel)
What You Get
- AlphaLogin 1.0.0 for WordPress (
alphalogin-1.0.0.zip) - Full, readable PHP and JavaScript source, no obfuscation
- Updates for the term of your licence
Works With
Part of the Alpha WordPress line, built with one admin kit: LicenseGuard, PushPress, MailFlow, MailDoctor, MeetPress, FolderPress.
The screenshots show the plugin on our demo site with sample data.
Everything included
- Passkeys (WebAuthn): sign in with a fingerprint, face or security key, without typing a us
- Two-factor codes (TOTP) with QR setup, 10 recovery codes, required for the roles you choos
- Single sign-on through the Alpha accounts portal: sign in once, land in every connected si
- Email magic links, single use
- Brute-force guard: per-IP and per-user lockouts with escalation, an allow-list, generic er
- Login page designer: colours, logo, background and custom CSS with a live preview
- Sessions: every device holding a session for an account, sign out any of them
- Profile section for users: their passkeys, 2FA and sessions
- Audit log of sign-ins, failures, lockouts and changes, with CSV export and retention
- Users overview: who has which factor
- Emergency kill switch file that turns 2FA off
- [alphalogin_button] shortcode for a portal sign-in button anywhere
Platforms
Requirements
- WordPress 6.0+
- PHP 8.0+
- HTTPS
In the download
Personal
One non-commercial project
- 1 activation seat
- 1 year of updates
- One end product
- Non-commercial use
- Community support
- 14-day refund window
Commercial
Ship paid products
- 5 activation seats
- 1 year of updates
- One paid end product
- Unlimited end users
- Priority support
- Source files
- 14-day refund window
Extended
Resell & white-label
- Unlimited activation seats
- Lifetime updates
- Unlimited end products
- White-label & resell
- 1-hour SLA
- Seat-free team use
- 14-day refund window
One purchase per product, no subscription. Each licence comes with a signed key — 1 seat on Personal, 5 seats on Commercial, unlimited seats on Extended. Paid licences can be refunded within 14 days from your order page.
- v1.0.0LatestOct 13, 2026
- First release
Be the first to review AlphaLogin | Passkeys, 2FA & SSO for WordPress — reviews come from customers who bought it, so every one is a verified purchase.
Frequently asked
Does it work without the Alpha accounts portal?
Yes. Passkeys, 2FA, magic links, the brute-force guard, sessions, the designer and the audit log all work on their own. SSO is the one feature that needs a portal.
What if a user loses their phone?
They sign in with one of the 10 recovery codes they were given at setup, or an administrator resets their 2FA from Users. There is also a kill-switch file that turns 2FA off site-wide in an emergency.
Can I require 2FA only for administrators?
Yes. Pick the roles that must have a second factor; everyone else is free to add one.
Does it replace my login page?
It keeps wp-login.php and adds to it: the passkey, magic-link and portal buttons appear under the normal form, and the designer styles the whole page.
How do I get the files after paying?
Straight after checkout you land on your order page with the download button and your licence key. A receipt is emailed to you, and every order stays in My library.
Which licence do I need?
Personal — One non-commercial project. Commercial — Ship paid products. Extended — Resell & white-label. The Licences tab compares them side by side.
On how many devices can I activate it?
1 seat on Personal, 5 seats on Commercial, unlimited seats on Extended.
How long do I get updates?
Personal: 1 year of updates, Commercial: 1 year of updates, Extended: lifetime updates, counted from your purchase.
Can I get a refund?
Yes — paid licences can be refunded within 14 days, straight from your order page.
Is the download safe?
The file was scanned with ClamAV when it was published. Its SHA-256 checksum is listed under Features → In the download, so you can verify the file you receive.
Do I need an account?
No. Checkout only needs your email. Signing in keeps all your purchases, keys and downloads together in My library.
More like this
MeetPress | Video Meetings & Bookings for WordPress
AlphaCall video rooms on any page, a booking calendar with services and weekly availability, a private room per booking, confirmations with…
★★★★★ No reviews yetTTechHarbour$29.00NewLicenseGuard | Licence Keys & Update Server for WordPress
A licence server for the software you sell: signed keys, seat-limited activations, a private update server with staged rollouts, a REST API…
★★★★★ No reviews yetTTechHarbour$29.00NewPushPress | Web Push & In-app Notifications for WordPress
Web push from your own server, an in-app notification centre and mobile push through Firebase: prompt designer, segments, schedules, automa…
★★★★★ No reviews yetTTechHarbour$19.00NewMailFlow | Newsletters, Automations & Email Builder for WordPress
Newsletters inside WordPress: a drag-and-drop builder with 28 templates, lists with double opt-in, segments, automations, send-time optimis…
★★★★★ No reviews yetTTechHarbour$29.00