Title: Sigil – Passkeys and Two-Factor Authentication
Author: Jean Galea
Published: 2 de agosto de 2026
Last modified: 5 de agosto de 2026
---
Buscar plugins
# Sigil – Passkeys and Two-Factor Authentication
Por [Jean Galea](https://profiles.wordpress.org/jeangalea/)
[Descargar](https://downloads.wordpress.org/plugin/sigil-2fa.0.3.3.zip)
* [Detalles](https://es.wordpress.org/plugins/sigil-2fa/#description)
* [Valoraciones](https://es.wordpress.org/plugins/sigil-2fa/#reviews)
* [Instalación](https://es.wordpress.org/plugins/sigil-2fa/#installation)
* [Desarrollo](https://es.wordpress.org/plugins/sigil-2fa/#developers)
[Soporte](https://wordpress.org/support/plugin/sigil-2fa/)
## Descripción
Sigil añade un segundo paso de autenticación a los inicios de sesión de WordPress.
Los usuarios registran una clave de acceso, una aplicación de autenticación, códigos
de recuperación o códigos por correo electrónico desde su perfil, y los administradores
pueden exigir la 2FA para los roles elegidos con un periodo de gracia.
**Métodos**
* Claves de acceso (WebAuthn), usando un autenticador de plataforma como Face ID,
Touch ID o Windows Hello, o una llave de seguridad de hardware. Requiere PHP
8.0 o superior.
* Aplicación de autenticación (TOTP), compatible con cualquier aplicación que cumpla
el RFC 6238.
* Códigos de recuperación: diez códigos de un solo uso, generados la primera vez
que se configura cualquier método.
* Códigos por correo electrónico: un código de seis dígitos enviado a la dirección
de correo de la cuenta.
**Exigencia**
* Exige la 2FA por rol, o para todos los que tengan una capacidad elegida.
* Establece un periodo de gracia para que los usuarios existentes tengan tiempo
de registrarse en lugar de quedar bloqueados en el siguiente inicio de sesión.
* Una columna «2FA» en la pantalla de Usuarios muestra quién la ha configurado
y quién no.
**Enrolment without the dashboard**
Put `[sigil_2fa]` on any page and users can set up and manage their methods there.
Sites that keep members out of wp-admin need this, and enforcement redirects to
that page when it exists instead of to an admin screen the user cannot open.
**Multisite**
Accounts are network-wide in WordPress, so second factors are too. An authenticator
or backup codes cover every site on the network, the policy is set once under Network
Admin, and the rate limiter counts across the network rather than per site. On a
network, resetting another user’s 2FA is a Network Admin action, which is how WordPress
governs user editing there.
Passkeys are bound to the domain they were created for, so by default a passkey
covers the site it was registered on. A network under one operator can widen that
to cover every subdomain site with the `sigil_rp_id` filter. It is opt-in because
widening lets any site under that domain request assertions, which matters when
sites have different administrators.
**REST API**
Routes under `sigil/v1` read a user’s methods, reset or remove them, read and edit
the policy, and describe or complete a pending login challenge so a decoupled front
end can run the second step itself. The challenge routes are authenticated by the
challenge token issued after the password step. Reading and changing anything else
requires the same capability as the equivalent screen.
This does not add a second factor to token authentication. A request that authenticates
with an application password never reaches the interactive login, so it is not challenged.
**Recuperación**
Tres formas de volver a entrar si se pierde un segundo factor:
* Los códigos de recuperación se generan y se muestran al registrarse por primera
vez.
* Un usuario con la capacidad `edit_users` puede restablecer la 2FA de otro usuario
desde la pantalla de Usuarios.
* `wp sigil reset ` borra el segundo factor de un usuario desde la línea
de comandos cuando nadie puede acceder al Escritorio.
**Contraseñas de aplicación**
La autenticación de dos factores no se aplica a las contraseñas de aplicación, que
autentican las peticiones de la API REST y de XML-RPC. La pantalla de ajustes lo
documenta, y las contraseñas de aplicación se pueden desactivar por rol.
### Third-party libraries
* QR Code Generator for JavaScript 2.0.4 by Kazuhiko Arase, MIT licensed, bundled
unmodified at `assets/js/vendor/qrcode.js` (https://github.com/kazuhikoarase/
qrcode-generator). Draws the authenticator QR in the browser.
* WebAuthn by Lukas Buchs, bundled in `vendor/`, used to verify passkey registrations
and assertions.
Neither contacts an external service.
## Instalación
1. Instálalo desde Plugins Añadir nuevo y busca «Sigil», o sube los archivos del
plugin a `/wp-content/plugins/sigil-2fa/`.
2. Actívalo desde el menú Plugins.
3. Ve a Usuarios Configuración de dos factores y registra tu primer método. Guarda
los códigos de recuperación que te muestre.
4. To require 2FA for other users, open Settings Sigil and choose the roles and grace
period. On a network, that screen is under Network Admin Settings Sigil.
5. If your users do not have dashboard access, create a page containing `[sigil_2fa]`
and they can enrol there.
## FAQ
### ¿Qué pasa si pierdo el teléfono y me quedo bloqueado?
Usa uno de los códigos de recuperación que se mostraron al configurar la 2FA por
primera vez. Si no los guardaste, otro administrador puede restablecer tu cuenta
desde la pantalla de Usuarios. Si nadie puede entrar en absoluto, cualquiera con
acceso al servidor ejecuta `wp sigil reset ` y se borra tu segundo
factor.
### ¿El plugin requiere una cuenta o un servicio externo?
No. Toda la autenticación ocurre en tu propio sitio. El plugin no contacta con ningún
servicio externo y no requiere una cuenta.
### ¿Funciona con contraseñas de aplicación, la API REST y XML-RPC?
Las contraseñas de aplicación omiten la 2FA por diseño, ya que así es como WordPress
autentica las peticiones automatizadas. La pantalla de ajustes lo documenta, y las
contraseñas de aplicación se pueden desactivar por rol para cerrar esa vía.
### ¿Qué versión de PHP necesito para las claves de acceso?
Las claves de acceso necesitan PHP 8.0 o superior. En versiones más antiguas de
PHP el plugin sigue funcionando y ofrece aplicaciones de autenticación, códigos
de recuperación y correo electrónico; solo el método de claves de acceso queda oculto.
### Does it work on multisite?
Yes. The policy is set once for the network under Network Admin Settings Sigil,
and a user’s authenticator or backup codes work on every site because WordPress
accounts are network-wide. Passkeys are bound to the domain they were created for,
so each site gets its own unless you widen that with the `sigil_rp_id` filter.
### Can users set up 2FA without access to wp-admin?
Yes. Put `[sigil_2fa]` on a page. Users manage their methods from there, and anyone
required to enrol is sent to that page rather than to the dashboard.
### ¿Puedo exigir la 2FA solo para administradores?
Sí. En Ajustes Sigil puedes elegir exactamente qué roles son obligatorios y establecer
un periodo de gracia para que se invite a las personas a configurarla en lugar de
bloquearlas de inmediato.
## Reseñas
No hay valoraciones para este plugin.
## Colaboradores y desarrolladores
«Sigil – Passkeys and Two-Factor Authentication» es un software de código abierto.
Las siguientes personas han colaborado con este plugin.
Colaboradores
* [ Jean Galea ](https://profiles.wordpress.org/jeangalea/)
[Traduce «Sigil – Passkeys and Two-Factor Authentication» a tu idioma.](https://translate.wordpress.org/projects/wp-plugins/sigil-2fa)
### ¿Interesado en el desarrollo?
[Revisa el código](https://plugins.trac.wordpress.org/browser/sigil-2fa/) , echa
un vistazo al [repositorio SVN](https://plugins.svn.wordpress.org/sigil-2fa/) o
suscríbete al [registro de desarrollo](https://plugins.trac.wordpress.org/log/sigil-2fa/)
por [RSS](https://plugins.trac.wordpress.org/log/sigil-2fa/?limit=100&mode=stop_on_copy&format=rss).
## Registro de cambios
#### 0.3.3
* Everyone sharing one address, as an office, a school or a mobile network does,
is no longer held to a single person’s allowance of attempts. A few colleagues
mistyping could stop everybody else signing in. Guessing any one account is bounded
by the same five attempts as before.
* A site behind a proxy can now tell the plugin the real visitor address with the
sigil_client_ip filter, instead of counting every visitor as the proxy.
* An account keeps only its newest few unspent verification sessions rather than
an unlimited pile of them.
* The allowed-methods screen now says when a role was left with every method because
nothing was ticked for it, rather than appearing to have discarded the save.
#### 0.3.2
* A percent sign in the challenge wording no longer breaks the login screen. The
line naming the person signing in was formatted rather than substituted, so wording
like «50% off» stopped anybody with a second factor from completing a sign-in.
* An account holding only passkeys is no longer asked for a code when resetting
its password. It was being emailed one that could never be accepted, which left
the account unrecoverable.
* The two-factor column on the users list now reads each account’s own rules rather
than those of the administrator looking at the page, so an account no longer
shows as having nothing set up when it has.
* Importing settings now says what happened, including when the imported policy
is switched on but names nobody.
* The page carrying the enrolment form is only adopted when an administrator wrote
it.
#### 0.3.1
* Repeated login guesses are now counted in a way that a burst of simultaneous
requests cannot outrun. The previous counter read a number, added one and wrote
it back, so guesses arriving together all read the same number, and the real
limit became however many requests could be made at once rather than the five
it promised.
* A server that does not report the visitor’s address no longer counts everybody
together, where five failures anywhere would have held up every account on the
site.
* Failed attempts are cleared out daily instead of being kept indefinitely.
* If the table the counter lives in goes missing, it is rebuilt rather than being
allowed to refuse every sign-in.
#### 0.3.0
* You are now emailed when a second factor is added to or removed from your account.
Adding one is how somebody who already has your password keeps access, and nothing
about the account looks different afterwards, so the only person who can notice
is you.
* Anyone who becomes subject to a 2FA requirement is emailed once, when their deadline
is set. People who never open the dashboard never saw the notice there, so the
first they knew of a policy was the day it stopped them.
* The login code email now says where the code was requested from. It says «may
be a proxy» rather than naming a location, because that is all the server actually
knows.
* Administrators are warned when the server clock has drifted far enough to reject
correct authenticator codes. Without it, a clock problem looks exactly like every
user mistyping at once.
* You can choose which method you are asked for first, if you have set up more
than one.
#### 0.2.2
* Adds two extension points: `sigil_challenge_text` for the wording of the two-
factor screen, and `sigil_manage_capability` for which capability reaches the
settings. Values are escaped after filtering, and the capability filter only
narrows, never widens.
* Nothing user-facing changed. Existing installs need do nothing.
#### 0.2.1
* Multisite: when an upgrade merges per-site passkey tables, the highest signature
counter for each credential is kept. Where the same authenticator was registered
on two sites, the lower one could otherwise win and the clone check would have
less to work with.
* Adds extension points so an add-on can rewrite the login code email, change where
enrolment sends people afterwards, and load the front-end styles outside the
shortcode. Nothing in the plugin behaves differently on its own.
* Nothing user-facing changed. Existing installs need do nothing.
#### 0.2.0
* Authenticator setup now shows a scannable QR code. It is drawn in the browser
by a bundled MIT-licensed library, so the provisioning secret is never sent anywhere.
* Security: a verification attempt now consumes its challenge token before the
code is checked, so a burst of parallel guesses cannot outrun the attempt counter,
and two simultaneous completions cannot both start a session. Mistyping a code
still lets you try again; the screen carries a fresh token.
* Multisite support. One set of credentials and one policy for the whole network,
edited under Network Admin, with rate limiting that counts across sites. Upgrading
an existing install carries its policy and passkeys up to network scope.
* Front-end enrolment with the `[sigil_2fa]` shortcode, for sites whose users have
no dashboard access. Enforcement sends people there when the page exists.
* A REST API under `sigil/v1` for reading 2FA state, managing methods, editing
the policy, and completing a login challenge from a decoupled front end.
* Security: resetting a user’s 2FA treated a missing actor as an exemption rather
than as nobody. That was reachable only from the command line before this release,
but it is now refused outright, with the unattended path named separately.
* Fixed the enrolment redirect pointing at the wrong admin screen, and the provisioning
URI appearing twice during authenticator setup.
#### 0.1.3
* Fixed the two-factor screen at login: it had no stylesheet, so the method switcher
rendered as a bare list and the buttons overlapped.
* Fixed passkey sign-in, which could never complete. The browser prompt was requested
through an authenticated endpoint the logged-out challenge screen could not reach.
* Email codes are now actually sent when the screen asks for one, and a wrong code
no longer invalidates the code already in your inbox.
* A refresh or a second tab no longer invalidates an outstanding passkey prompt.
#### 0.1.2
* Atribución de autor actualizada a Jean Galea.
#### 0.1.1
* El plugin pasa a llamarse Sigil. El dominio de texto es ahora `sigil-2fa` y el
comando de WP-CLI es `wp sigil`.
* Las traducciones ya no se incluyen; provienen de translate.wordpress.org.
#### 0.1.0
* Primera versión: claves de acceso, aplicaciones de autenticación, códigos de
recuperación y códigos por correo electrónico.
* Exigencia por rol con un periodo de gracia configurable.
* Recuperación ante bloqueo: códigos de recuperación, restablecimiento por administrador
y un comando de restablecimiento de WP-CLI.
* Control de contraseñas de aplicación por rol.
## Meta
* Versión **0.3.3**
* Última actualización **hace 5 días**
* Instalaciones activas **Menos de 10**
* Versión de WordPress ** 6.9 o superior **
* Probado hasta **7.0.3**
* Versión de PHP ** 7.4 o superior **
* Idioma
* [English (US)](https://wordpress.org/plugins/sigil-2fa/)
* Etiquetas:
* [2FA](https://es.wordpress.org/plugins/tags/2fa/)[authentication](https://es.wordpress.org/plugins/tags/authentication/)
[passkeys](https://es.wordpress.org/plugins/tags/passkeys/)[security](https://es.wordpress.org/plugins/tags/security/)
[two factor](https://es.wordpress.org/plugins/tags/two-factor/)
* [Vista avanzada](https://es.wordpress.org/plugins/sigil-2fa/advanced/)
## Valoraciones
Aún no se han enviado valoraciones.
[Your review](https://wordpress.org/support/plugin/sigil-2fa/reviews/#new-post)
[Ver todas las valoraciones](https://wordpress.org/support/plugin/sigil-2fa/reviews/)
## Colaboradores
* [ Jean Galea ](https://profiles.wordpress.org/jeangalea/)
## Soporte
¿Tienes algo que decir? ¿Necesitas ayuda?
[Ver el foro de soporte](https://wordpress.org/support/plugin/sigil-2fa/)