Sigil for WordPress: A First Look at Free Passkey and 2FA Login Protection

WordPress login security has long been a patchwork problem. You either bolt 2FA onto a security suite you don't fully need, wrap your login page in a third-party SSO service, or cobble together a Google Authenticator plugin that hasn't been updated since PHP 7.4 was cool. Sigil, a newly published plugin on the WordPress.org repository, is trying to be the dedicated answer: a standalone, free, open-source plugin that does 2FA and passkeys and nothing else.

I installed it on a test multisite network and a single-site install to see whether "just 2FA, done well" is actually a viable pitch in 2024.

What Sigil actually does

Sigil adds four authentication factors to the WordPress login screen:

• Passkeys (WebAuthn) — Face ID, Windows Hello, YubiKey, or platform authenticators, registered per-user.
• TOTP authenticator apps — the standard Google Authenticator/Authy/1Password flow with a QR code on enrollment.
• Backup codes — a downloadable one-time-use code set generated at enrollment.
• Email codes — a fallback factor sent to the user's registered email at login time.

On top of the factors themselves, the two features that separate Sigil from a hobby plugin are:

1. Role-based enforcement with grace periods. You can require 2FA for Administrators and Editors immediately, while giving Subscribers a 14-day grace period before they're locked out of the dashboard without enrolling. This is configured per-role from Settings → Sigil, not via a code snippet.
2. REST API routes for decoupled auth. If you're running WordPress headless (Next.js, Nuxt, or a custom SPA front end) hitting the REST API or GraphQL, Sigil exposes REST endpoints for challenge/response so you're not stuck faking a wp-login.php POST from your front end.

Multisite works at the network level — you can enforce a 2FA policy network-wide from the Network Admin, or let each subsite override it, which is more granular than most plugins bother to offer.

Setup experience

Install took about four minutes end to end on a standard Bedrock/Nginx stack. A few notes:

• Passkey registration requires HTTPS (WebAuthn spec requirement) — if you're testing locally over HTTP, only TOTP/email/backup codes will register, which tripped me up for a minute before I remembered why.
• The front-end shortcode [sigil_enroll] renders the same enrollment UI used in wp-admin, which matters if you're running a membership site and don't want subscribers ever touching /wp-admin/.
• There's no setup wizard beyond the settings page — you go role by role and toggle enforcement, which is fine but means a network admin with 40 roles across subsites will be clicking for a while.

Concrete use cases

• Agency managing client sites: Enforce 2FA for Administrator and Editor roles only, with a 7-day grace period, so client logins aren't broken overnight but nobody with publish access can skip it forever.
• Membership or LMS site: Use the [sigil_enroll] shortcode on a "My Account" page so Subscriber-level users can add a passkey without ever seeing wp-admin.
• Headless WordPress: A decoupled front end (say, a Next.js storefront using WooCommerce's REST API) calls Sigil's REST routes directly to challenge a user for TOTP after password auth, without redirecting to wp-login.php at all.
• Multisite network with mixed compliance needs: Force 2FA network-wide for network admins while letting each subsite's site admin decide their own subscriber policy.

Pricing

Sigil is 100% free and open source, distributed through the WordPress.org plugin repository under the GPL. There is no premium tier, no paid add-on pack, and no license key gating passkeys behind a paywall — which is notable, since passkey support is usually the feature vendors reserve for paid plans.

How it stacks up

	Sigil	Wordfence Security	Google Authenticator plugin ecosystem (e.g. miniOrange, WP 2FA)	Duo Security
Price	Free, no tiers	Free core; Premium $119/yr (1 site) for real-time firewall/scanning bundled with 2FA	Free core; premium add-ons typically $29–$79/yr per site for SMS/branding	Free up to 10 users; Essentials ~$3/user/mo; Advantage ~$6/user/mo; Premier custom
Passkey (WebAuthn) support	Yes, native	No — TOTP/email only	Rare; most rely on TOTP or SMS	Yes, via Duo's platform
Scope	2FA/passkeys only, single-purpose	Full security suite (firewall, malware scan, 2FA as one module)	2FA only, but often tied to a specific vendor's broader identity suite	Full identity/MFA platform, not WordPress-specific
Role-based enforcement + grace period	Yes, native UI	Basic — can require 2FA for specific roles, no grace period timer	Varies by plugin; WP 2FA has grace periods, others don't	Enforced via Duo policy, not WordPress roles directly
Headless/REST API support	Yes, dedicated REST routes	No	No	Yes, via Duo Auth API (requires separate integration work)
Best for	Sites that want dedicated, modern 2FA without extra bloat	Sites that want 2FA bundled with a firewall and malware scanner	Sites already committed to a specific 2FA vendor's broader plugin suite	Enterprises needing centralized MFA across WordPress and non-WordPress systems

Where it falls short

• No SMS fallback. If your user base skews toward less technical users who don't have an authenticator app installed and don't check email reliably, Sigil's factor list (passkey, TOTP, backup codes, email) has a gap that Duo and some Google Authenticator forks fill with SMS.
• No built-in brute-force protection or login rate limiting. Wordfence bundles this; with Sigil you'd want a companion plugin (or your host's WAF) handling login attempt throttling.
• New plugin, small install base. As of this writing it's freshly published — there isn't yet a long track record of security audits or CVE history to point to, which matters if you're deciding for a regulated client site today versus in six months.

Verdict

If you want 2FA and passkeys without paying for a security suite you don't need, or without wiring together an aging Google Authenticator plugin, Sigil is worth installing today — it's free, the role/grace-period enforcement is genuinely more usable than most competitors', and native passkey support out of the box is still rare at this price point (zero dollars). If you need brute-force protection, malware scanning, or SMS-based fallback for a less technical user base, pair it with something else or look at Wordfence Premium or Duo instead.