wp-login.php<\/code> (or WooCommerce login), the user chooses biometric sign-in. The plugin issues a WebAuthn challenge via the REST API, verifies the signed response, and creates a normal WordPress session.<\/li>\n<\/ol>\n\nREST routes live under csbisebi-biometric-login\/v1<\/code> on your own site (for example \/wp-json\/csbisebi-biometric-login\/v1\/auth\/options<\/code>). No external API keys are required.<\/p>\n\nWooCommerce<\/h4>\n\n
When WooCommerce is active, CS BioLogin adds a My Account<\/strong> tab, checkout\/account login prompts, and automatic use of the account area instead of a standalone management page.<\/p>\n\nRequirements<\/h4>\n\n\n- WordPress 6.2 or later<\/li>\n
- PHP 7.4+ with OpenSSL<\/li>\n
- HTTPS<\/strong> on production (WebAuthn requires a secure context;
localhost<\/code> and *.local<\/code> are allowed for development)<\/li>\n<\/ul>\n\nPrivacy and data storage<\/h4>\n\n\n- Biometric samples stay on the user's device.<\/li>\n
- The plugin stores passkey public keys, optional device labels, timestamps, and security log entries in your WordPress database.<\/li>\n
- Uninstalling the plugin (when data removal is enabled via uninstall) drops the custom credentials table and plugin options.<\/li>\n<\/ul>\n\n\n
\n- Upload the plugin folder
cs-biologin-seamless-biometric-authentication<\/code> to \/wp-content\/plugins\/<\/code> (the zip must contain readme.txt<\/code> and cs-biologin.php<\/code> at the root of that folder, not inside a trunk\/<\/code> subfolder).<\/li>\n- Activate CS BioLogin \u2013 Seamless Biometric Authentication<\/strong> on the Plugins<\/strong> screen.<\/li>\n
- Ensure your site uses HTTPS<\/strong> in production.<\/li>\n
- Go to Biometric Login<\/strong> and save your preferences.<\/li>\n
- Log in as a test user, open Users \u2192 Profile<\/strong> (or WooCommerce My Account \u2192 CS BioLogin<\/strong>), and register a passkey before testing front-end login.<\/li>\n<\/ol>\n\n\n
\nDoes this store my fingerprint or face on the server?<\/h3><\/dt>\nNo. WebAuthn keeps biometrics on the device. The site only stores a public key used to verify future logins.<\/p><\/dd>\n
Does the plugin call external services?<\/h3><\/dt>\nNo. Challenges, verification, and credential storage all run on your WordPress installation. JavaScript and CSS are bundled with the plugin (no third-party CDNs).<\/p><\/dd>\n
Is HTTPS required?<\/h3><\/dt>\nYes, for production sites. The plugin shows an admin notice if HTTPS is missing (localhost and .local<\/code> hosts are exempt for development).<\/p><\/dd>\nCan users still log in with a password?<\/h3><\/dt>\nYes, unless the administrator enables Force Biometric Login<\/strong>, which blocks password sign-in for any account that already has a registered passkey. Accounts without one yet can still use their password until they set one up.<\/p><\/dd>\nIs WooCommerce supported?<\/h3><\/dt>\nYes. Device management appears under My Account<\/strong>, and biometric login can appear on WooCommerce login forms when enabled.<\/p><\/dd>\nPassword managers block the biometric prompt. What should I do?<\/h3><\/dt>\nExtensions such as 1Password, Bitwarden, or LastPass may intercept passkey prompts. Enable passkey support in the manager or disable autofill for your site so the native OS dialog (Touch ID, Face ID, Windows Hello) can appear.<\/p><\/dd>\n
Can administrators manage user devices?<\/h3><\/dt>\nYes. Use Biometric Login \u2192 User Management<\/strong> to reset devices, view logs, and register passkeys on behalf of users (with appropriate capability checks). To remove every registered device for every user in one action, use the \"Reset All Devices for All Users\" button in the Security Settings tab's Danger Zone: it requires typing a confirmation phrase and is logged to the Security Logs.<\/p><\/dd>\nWhat shortcodes does this plugin provide?<\/h3><\/dt>\n[csbisebi_device_manager]<\/code><\/strong>: Renders the full \"Manage Biometric Devices\" panel: registered device list, add\/rename\/remove controls, and a registration form. Only visible to logged-in users; logged-out visitors see a \"Please log in\" notice instead. The plugin auto-creates a page containing this shortcode on activation.<\/p>\n\n[csbisebi_login_button]<\/code><\/strong>: Renders only a \"Login with Biometrics\" trigger button, safe to place inside a normal page, a widget, or a page-builder popup (e.g. Elementor). It prints nothing at all for a visitor who is already logged in. What happens on click is controlled by Biometric Login \u2192 Implementation \u2192 Popup Behavior<\/strong>:<\/p>\n\n\n- Show the sign-in popup<\/strong> (default): opens a popup with the biometric prompt plus optional password\/register buttons.<\/li>\n
- Authenticate directly<\/strong>: skips the popup and triggers the biometric prompt immediately.<\/li>\n<\/ul><\/dd>\n
What filter hooks does this plugin provide for developers?<\/h3><\/dt>\nAll filters below can be added to your theme's functions.php<\/code> or a site-specific plugin.<\/p>\n\ncsbisebi_button_text<\/code><\/strong>: Change the biometric login button's text everywhere it appears (login screen, [csbisebi_login_button]<\/code> shortcode, WooCommerce account button), overriding the \"Button Text\" UI setting.<\/p>\n\nadd_filter( 'csbisebi_button_text', function ( $text ) {\n return 'Sign in with Face ID';\n} );\n<\/code><\/pre>\n\ncsbisebi_popup_header_icon<\/code><\/strong>: Replace the fingerprint icon shown in the sign-in popup's header. Return raw HTML\/SVG markup; return an empty string (the default) to keep the built-in, theme-colored fingerprint icon.<\/p>\n\nadd_filter( 'csbisebi_popup_header_icon', function ( $icon_html ) {\n return '<img src=\"https:\/\/example.com\/my-icon.svg\" width=\"32\" height=\"32\" alt=\"\" \/>';\n} );\n<\/code><\/pre>\n\ncsbisebi_popup_heading_title<\/code><\/strong>: Change the heading title in the sign-in popup's header (defaults to the site name).<\/p>\n\nadd_filter( 'csbisebi_popup_heading_title', function ( $title ) {\n return 'Welcome back!';\n} );\n<\/code><\/pre>\n\ncsbisebi_popup_guest_notice<\/code><\/strong>: Change the helper text shown under the popup header about guest\/private browsing windows.<\/p>\n\nadd_filter( 'csbisebi_popup_guest_notice', function ( $text ) {\n return 'Using a private window? You may need your phone or a security key instead.';\n} );\n<\/code><\/pre>\n\ncsbisebi_popup_footer_text<\/code><\/strong>: Change the privacy note shown at the bottom of the sign-in popup (next to the green checkmark icon).<\/p>\n\nadd_filter( 'csbisebi_popup_footer_text', function ( $text ) {\n return 'Your biometric data stays on your device.';\n} );\n<\/code><\/pre>\n\ncsbisebi_force_biometric_enabled<\/code><\/strong>: Override whether \"Force Biometric Login\" is enforced, independent of the saved setting. Return false<\/code> to force it off (e.g. from a must-use plugin or an emergency break-glass hook) without touching the database.<\/p>\n\nadd_filter( 'csbisebi_force_biometric_enabled', function ( $enabled ) {\n return false;\n} );\n<\/code><\/pre>\n\ncsbisebi_plugin_name<\/code><\/strong>: Change the plugin's display name shown in menus, headings, and the WooCommerce account tab.<\/p>\n\nadd_filter( 'csbisebi_plugin_name', function ( $name ) {\n return 'ABCD Passkey Login';\n} );\n<\/code><\/pre><\/dd>\n\n<\/dl>\n\n\n1.3.0<\/h4>\n\n\n- Added a \"Restrict Roles\" switch, replacing the old Allowed Roles list, enforced at both passkey registration and login.<\/li>\n
- Added a working \"Force Biometric Login\" setting that blocks password login for accounts with a registered passkey, exempting accounts that have not registered one yet, plus a
csbisebi_force_biometric_enabled<\/code> filter for developers.<\/li>\n- Added \"Require Re-Authentication\" enforcement for adding and removing a device, confirmed with your account password.<\/li>\n
- Added the
[csbisebi_login_button]<\/code> shortcode, a login button safe to use inside Elementor popups and other page builders, replacing the old custom CSS selector setting. It now prints nothing for a visitor who is already logged in.<\/li>\n- Added a \"Popup Behavior\" setting (Implementation tab) so the
[csbisebi_login_button]<\/code> shortcode can either open the sign-in popup (default) or authenticate directly on click.<\/li>\n- Added \"Show 'Use Password Instead' Button\" and \"Show 'Register a New Account' Button\" toggles (UI Settings tab) to hide either option from the sign-in popup.<\/li>\n
- Removed the \"Show Icon on Button\" setting: it had no effect. Added the
csbisebi_button_text<\/code> filter for developers who want to override the button label in code instead.<\/li>\n- Removed the \"Hide Button on Unsupported Browsers\" setting: it had no effect. Unsupported browsers now log a console warning instead.<\/li>\n
- Added
csbisebi_popup_header_icon<\/code>, csbisebi_popup_heading_title<\/code>, csbisebi_popup_guest_notice<\/code>, and csbisebi_popup_footer_text<\/code> filters to let developers override the sign-in popup's header icon, heading, guest-window notice, and footer text.<\/li>\n- Documented all shortcodes and developer filter hooks in the FAQ.<\/li>\n
- Renamed the Security Settings tab's URL slug from
tab=advanced<\/code> to tab=security-settings<\/code>.<\/li>\n- Added a \"Danger Zone\" section on the Security Settings tab with a \"Reset All Devices for All Users\" action (admin-only, phrase-confirmed), which removes every registered biometric device site-wide and records a
global_reset<\/code> entry in the security logs.<\/li>\n- Added Role and Last Activity columns to the User Management table, sourced from the security logs.<\/li>\n
- Added a dismissible WordPress.org review notice on the settings page.<\/li>\n
- Fixed the device name entered during registration not being used as the passkey's name in the browser or OS passkey picker.<\/li>\n
- Renamed \"Advanced Settings\" to \"Security Settings\" and moved related settings into it.<\/li>\n
- Redesigned the settings screens with toggle switches and CS BioLogin brand colors.<\/li>\n
- Removed unused legacy settings, Allow Password Fallback and Allow REST Account Registration, that had no effect.<\/li>\n
- General code cleanup for WordPress and VIP coding standards.<\/li>\n<\/ul>\n\n
1.2.2<\/h4>\n\n\n- Moved security log storage from option table to custom table <\/li>\n
- Filter\/search logs logs<\/li>\n
- Fixed the issue where logs was not showing correct browser.<\/li>\n<\/ul>\n\n
1.2.1<\/h4>\n\n\n- Fixed the minor issue where activating the plugin triggered, fatal error.<\/li>\n<\/ul>\n\n
1.2.0<\/h4>\n\n\n- Fixed the issue where, the registration working when ZOHO vault is enabled<\/li>\n
- Added i18n support in js files for translation<\/li>\n<\/ul>\n\n
1.0.0<\/h4>\n\n\n- Initial release on the WordPress Plugin Directory.<\/li>\n
- WebAuthn \/ FIDO2 \/ Passkeys registration and authentication (ES256 and RS256).<\/li>\n
- Passwordless login on the WordPress login screen with optional password fallback.<\/li>\n
- WooCommerce: My Account endpoint, checkout and account login popups, and device management UI.<\/li>\n
- Multi-device support with rename, update passkey, remove, and duplicate-device handling.<\/li>\n
- Admin settings (roles, force biometric, rate limits, lockout, UI options) plus security event logs and user device management.<\/li>\n
- Passkey setup reminder banner for users without a registered device.<\/li>\n
- No external services or CDNs; credentials stored locally in the database.<\/li>\n<\/ul>","raw_excerpt":"Secure biometric login (WebAuthn \/ FIDO2 \/ Passkeys) for WordPress and WooCommerce using Face ID, Touch ID, or fingerprint.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/vi.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/315026","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vi.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/vi.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/vi.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=315026"}],"author":[{"embeddable":true,"href":"https:\/\/vi.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/concatstring"}],"wp:attachment":[{"href":"https:\/\/vi.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=315026"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/vi.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=315026"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/vi.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=315026"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/vi.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=315026"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/vi.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=315026"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/vi.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=315026"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}