Passwordless X1280

Сүрөттөө

Passwordless X1280 integrates WordPress with the X1280 Passwordless Authentication Server, enabling secure passwordless login through the biometric capabilities already built into your users’ smartphones — Face ID and fingerprint recognition — based on the ITU-T X.1280 international standard.

Forget passwords, password resets, and phishing risks. Instead of asking users to type a password, your site presents an automatic password that users simply verify and approve in the Passwordless X1280 mobile app.

Why Passwordless X1280?

• Built on the ITU-T X.1280 international standard – a globally recognized passwordless authentication framework designed for the zero-trust era.
• Mutual authentication – users verify the service before authenticating, helping prevent phishing and fraudulent login pages.
• Smartphone-based biometrics – authenticate securely with Face ID or fingerprint recognition, even when the computer itself has no biometric hardware (out-of-band authentication).
• No additional hardware required – works with existing smartphones and browsers; no security keys or dedicated sensors to buy.
• Free for B2C online services – provided by the non-profit Passwordless Alliance to promote safer digital services worldwide.

How It Works

Unlike traditional login systems where only the user is authenticated, X.1280 introduces mutual authentication:

1. The WordPress login page displays a unique auto-password.
2. The user checks that the same auto-password appears in the Passwordless X1280 mobile app.
3. After confirming the service identity, the user approves the login with smartphone biometrics.
4. Authentication completes securely — no password is typed or transmitted.

This ensures users are communicating with the legitimate website before any authentication takes place.

Key Features

• Adds a Password / Passwordless login option to wp-login.php
• Secure WebAuthn / passkey-based authentication
• Admin settings panel for X1280 server configuration
• Option to disable password-based login entirely
• Uses WordPress hooks only — no core file modifications
• Compatible with multisite environments
• Works alongside caching and security plugins

Automatic Page Creation

Upon activation, the plugin automatically creates the following pages:

• Passwordless X1280 Login Page – displays the passwordless login interface using the [px1280_login] shortcode
• Passwordless X1280 Register / Unregister Page – lets users register and manage passkeys using the [px1280_manage] shortcode

Both pages can be edited or reassigned from the WordPress admin panel if needed.

Security

• No passwords are transmitted during passwordless authentication
• Out-of-band approval on a separate trusted device (the user’s smartphone)
• Uses WordPress nonces and secure server-side verification
• Requires HTTPS (a WebAuthn requirement)
• Does not modify WordPress core files

Requirements

• A WordPress site served over HTTPS
• Users need a smartphone with the free Passwordless X1280 mobile app (App Store / Google Play)
• A Server Key for the X1280 Authentication Server (see the FAQ for how to obtain one)

External Services

This plugin connects to an external service to enable passwordless authentication.

• Service name: X1280 Authentication Server
• Service URL: http://wp-x1280.dualauth.com
• Service provider: Passwordless Alliance

Purpose: the service processes passwordless authentication requests using WebAuthn (passkeys).

Data sent:

• Username (userId)
• Authentication session data (token, random, sessionId)
• Server key (for verification)

Data received:

• Authentication result (approved / denied)
• Service password (OTP)
• Push notification data

When data is sent:

• During login (passwordless authentication)
• During registration / unregistration of passkeys

About the Passwordless Alliance

The Passwordless Alliance is a non-profit organization headquartered in Geneva that distributes Passwordless X1280 software free of charge to B2C online services worldwide. The underlying technology is standardized by the ITU-T as Recommendation X.1280.