Passkeys help WordPress admins, but recovery still decides the rollout.

Start with admins and staff

Passkeys pay off first where you control training, device choice, and recovery — and that describes admin and staff accounts, not your whole customer base. These are also the accounts an attacker wants most, and the ones where a phishing-resistant credential removes the single biggest risk: a reused password pasted into a fake login page. Prove the flow here, learn what your team trips over, then decide whether customers are next.

Passwordless versus second factor — pick one on purpose

A passkey can do two different jobs. It can replace the password entirely in a passwordless sign-in, or it can sit after the password as an additional factor. Those are different security and recovery decisions, not a wording choice. Passwordless removes the password as an attack surface but makes the device the account; passkey-as-second-factor keeps a password fallback but still asks for the device. Be explicit about which one a release actually supports so nobody assumes the stronger model is in place when it is not.

Recovery still decides the rollout

A passkey is bound to hardware, so a lost laptop or wiped phone is the scenario that matters. Before enrolling anyone, confirm there is a way back in that does not depend on that one device: a recovery link emailed to the address on file, recovery codes generated in advance, and ideally more than one registered credential so a second device keeps the account reachable. The recovery link signs the admin in to re-enrol — it does not quietly disable their protection.

Do not remove fallback planning

• Keep recovery codes available and stored for every enrolled user.
• Register more than one credential when the release supports it, so one lost device is not a lockout.
• Write down exactly what support can and cannot ask for during recovery.
• Treat customer passkeys as a paid, release-verified capability, not a default promise.

Where passkeys stop

A passkey proves someone holds a registered device; it does not manage that device, scan it for malware, or vouch for who is behind it beyond the local unlock. Awthy is not a full identity provider, a device-management suite, or a helpdesk replacement, and pretending otherwise sets up a support failure later. Use passkeys for what they are genuinely good at — strong, phishing-resistant sign-in — and keep recovery and support boundaries doing the rest.