Title: Passwordless X1280
Author: Passwordless Alliance
Published: <strong>Июль 28, 2026-ж.</strong>
Last modified: Июль 28, 2026-ж.

---

Плагиндерди издөө

![](https://ps.w.org/passwordless-x1280/assets/banner-772x250.png?rev=3625355)

![](https://ps.w.org/passwordless-x1280/assets/icon.svg?rev=3625383)

# Passwordless X1280

 Автору [Passwordless Alliance](https://profiles.wordpress.org/passwordlessalliance/)

[Жүктөө](https://downloads.wordpress.org/plugin/passwordless-x1280.1.0.2.zip)

 * [Кенен маалымат](https://ky.wordpress.org/plugins/passwordless-x1280/#description)
 * [Сын-пикирлер](https://ky.wordpress.org/plugins/passwordless-x1280/#reviews)
 *  [Орнотуу](https://ky.wordpress.org/plugins/passwordless-x1280/#installation)
 * [Development](https://ky.wordpress.org/plugins/passwordless-x1280/#developers)

 [Колдоо](https://wordpress.org/support/plugin/passwordless-x1280/)

## Сүрөттөө

**Passwordless X1280** integrates WordPress with the **X1280 Passwordless Authentication
Server**, enabling secure passwordless login through the biometric capabilities 
already built into your users’ smartphones — Face ID and fingerprint recognition—
based on the **ITU-T X.1280** international standard.

Forget passwords, password resets, and phishing risks. Instead of asking users to
type a password, your site presents an automatic password that users simply verify
and approve in the Passwordless X1280 mobile app.

#### Why Passwordless X1280?

 * **Built on the ITU-T X.1280 international standard** – a globally recognized 
   passwordless authentication framework designed for the zero-trust era.
 * **Mutual authentication** – users verify the service before authenticating, helping
   prevent phishing and fraudulent login pages.
 * **Smartphone-based biometrics** – authenticate securely with Face ID or fingerprint
   recognition, even when the computer itself has no biometric hardware (out-of-
   band authentication).
 * **No additional hardware required** – works with existing smartphones and browsers;
   no security keys or dedicated sensors to buy.
 * **Free for B2C online services** – provided by the non-profit Passwordless Alliance
   to promote safer digital services worldwide.

#### How It Works

Unlike traditional login systems where only the user is authenticated, X.1280 introduces**
mutual authentication**:

 1. The WordPress login page displays a unique auto-password.
 2. The user checks that the same auto-password appears in the Passwordless X1280 mobile
    app.
 3. After confirming the service identity, the user approves the login with smartphone
    biometrics.
 4. Authentication completes securely — no password is typed or transmitted.

This ensures users are communicating with the legitimate website before any authentication
takes place.

#### Key Features

 * Adds a **Password / Passwordless** login option to `wp-login.php`
 * Secure WebAuthn / passkey-based authentication
 * Admin settings panel for X1280 server configuration
 * Option to disable password-based login entirely
 * Uses WordPress hooks only — no core file modifications
 * Compatible with multisite environments
 * Works alongside caching and security plugins

#### Automatic Page Creation

Upon activation, the plugin automatically creates the following pages:

 * **Passwordless X1280 Login Page** – displays the passwordless login interface
   using the `[px1280_login]` shortcode
 * **Passwordless X1280 Register / Unregister Page** – lets users register and manage
   passkeys using the `[px1280_manage]` shortcode

Both pages can be edited or reassigned from the WordPress admin panel if needed.

#### Security

 * No passwords are transmitted during passwordless authentication
 * Out-of-band approval on a separate trusted device (the user’s smartphone)
 * Uses WordPress nonces and secure server-side verification
 * Requires HTTPS (a WebAuthn requirement)
 * Does not modify WordPress core files

#### Requirements

 * A WordPress site served over **HTTPS**
 * Users need a smartphone with the free **Passwordless X1280 mobile app** ([App Store](https://apps.apple.com/us/app/autootp/id1290713471)/
   [Google Play](https://play.google.com/store/apps/details?id=com.estorm.autopassword))
 * A **Server Key** for the X1280 Authentication Server (see the FAQ for how to 
   obtain one)

#### External Services

This plugin connects to an external service to enable passwordless authentication.

 * **Service name:** X1280 Authentication Server
 * **Service URL:** http://wp-x1280.dualauth.com
 * **Service provider:** [Passwordless Alliance](https://www.passwordlessalliance.org/)

**Purpose:** the service processes passwordless authentication requests using WebAuthn(
passkeys).

**Data sent:**

 * Username (userId)
 * Authentication session data (token, random, sessionId)
 * Server key (for verification)

**Data received:**

 * Authentication result (approved / denied)
 * Service password (OTP)
 * Push notification data

**When data is sent:**

 * During login (passwordless authentication)
 * During registration / unregistration of passkeys

#### About the Passwordless Alliance

The [Passwordless Alliance](https://www.passwordlessalliance.org/) is a non-profit
organization headquartered in Geneva that distributes Passwordless X1280 software
free of charge to B2C online services worldwide. The underlying technology is standardized
by the ITU-T as [Recommendation X.1280](https://www.itu.int/rec/T-REC-X.1280-202403-P).

## Орнотуу

 1. Upload the `passwordless-x1280` folder to the `/wp-content/plugins/` directory,
    or install the plugin through the WordPress plugins screen directly.
 2. Activate the plugin through the **Plugins** menu in WordPress.
 3. Go to **Dashboard  Passwordless X1280** and configure the following: **Server Key**(
    provided by X1280), **Authentication Server Domain** (port 11040), **Push Server
    Domain** (port 15010), and, optionally, disable password-based login.
 4. Ask your users to install the Passwordless X1280 mobile app and register their 
    account on the automatically created **Register / Unregister** page.
 5. Log in through `wp-login.php` or the generated login page using the **Passwordless**
    option.

## FAQ.KG

### Is Passwordless X1280 free?

Yes. Passwordless X1280 is provided free of charge by the non-profit Passwordless
Alliance for B2C (consumer-facing) online services worldwide. It is not licensed
for internal systems whose users are employees, contractors, or agents of the operating
organization. The companion mobile app is free for users and ad-supported, which
is how the Alliance funds free distribution.

### What do my users need?

A smartphone with the free Passwordless X1280 mobile app installed ([App Store](https://apps.apple.com/us/app/autootp/id1290713471)/
[Google Play](https://play.google.com/store/apps/details?id=com.estorm.autopassword)).
Biometric verification uses the phone’s own Face ID or fingerprint sensor, so no
extra hardware is needed on PCs or other devices. A single app can manage passwordless
login for multiple online services.

### Where do I get a Server Key?

Register (free of charge) as a Service Member of the Passwordless Alliance and submit
a passwordless service application; a license key is issued after verification. 
For testing purposes, select “testing” as the purpose of use when applying and a
key is issued automatically, although domain linking is not supported for test keys.
See [Become a member](https://www.passwordlessalliance.org/en/become-a-member/) 
for details. The X1280 server application itself is distributed via [Docker Hub](https://hub.docker.com/r/dualauth/passwordless-x1280-single).

### Does my site need HTTPS?

Yes. WebAuthn only works on sites served over HTTPS, so a valid SSL/TLS certificate
is required.

### Can users still log in with a password?

Yes. By default, the standard password login remains available alongside the passwordless
option on `wp-login.php`. Administrators can disable password-based login from the
plugin settings if they want passwordless-only authentication.

### What if a user loses or replaces their phone?

If password login is enabled, the user can regain access through WordPress’s standard
password recovery, then unregister the old device and register the new smartphone
on the Register / Unregister page (`[px1280_manage]`).

### Does the plugin modify WordPress core files?

No. It uses standard WordPress hooks only, and it is compatible with multisite environments
as well as common caching and security plugins.

## Сын-пикирлер

There are no reviews for this plugin.

## Contributors & Developers

“Passwordless X1280” is open source software. The following people have contributed
to this plugin.

Мүчөлөрү

 *   [ Passwordless Alliance ](https://profiles.wordpress.org/passwordlessalliance/)

[Translate “Passwordless X1280” into your language.](https://translate.wordpress.org/projects/wp-plugins/passwordless-x1280)

### Interested in development?

[Browse the code](https://plugins.trac.wordpress.org/browser/passwordless-x1280/),
check out the [SVN repository](https://plugins.svn.wordpress.org/passwordless-x1280/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/passwordless-x1280/)
by [RSS](https://plugins.trac.wordpress.org/log/passwordless-x1280/?limit=100&mode=stop_on_copy&format=rss).

## Өзгөртүүлөр

#### 1.0.2

 * Initial release
 * Passwordless login integration
 * Admin configuration panel
 * Automatic page creation
 * Password login restriction option
 * Shortcode support

## Мета

 *  Нуска **1.0.2**
 *  Акыркы жаңыртуу **2 жума мурун**
 *  Активдүү орнотуулар **Fewer than 10**
 *  WordPress нускасы ** 5.8 же андан жогору **
 *  Tested up to **7.0.3**
 *  PHP нускасы ** 7.4 же андан жогору **
 *  Тил
 * [English (US)](https://wordpress.org/plugins/passwordless-x1280/)
 * Тег:
 * [authentication](https://ky.wordpress.org/plugins/tags/authentication/)[login](https://ky.wordpress.org/plugins/tags/login/)
   [passwordless](https://ky.wordpress.org/plugins/tags/passwordless/)[security](https://ky.wordpress.org/plugins/tags/security/)
   [webauthn](https://ky.wordpress.org/plugins/tags/webauthn/)
 *  [Advanced View](https://ky.wordpress.org/plugins/passwordless-x1280/advanced/)

## Рейтинг

Азырынча эч кандай сын-пикир жок.

[Your review](https://wordpress.org/support/plugin/passwordless-x1280/reviews/#new-post)

[See all reviews](https://wordpress.org/support/plugin/passwordless-x1280/reviews/)

## Мүчөлөрү

 *   [ Passwordless Alliance ](https://profiles.wordpress.org/passwordlessalliance/)

## Колдоо

Комментарийлер барбы? Жардам керекпи?

 [Колдоо форумун көрүү](https://wordpress.org/support/plugin/passwordless-x1280/)