WP Magic Link Login is a WordPress security plugin that enables passwordless authentication for your website. Instead of relying on traditional passwords — which users often choose weakly or reuse across sites — this plugin lets visitors log in by receiving a secure, time-limited link sent directly to their email address. Once the user clicks the link, they are automatically logged in without ever being prompted for a password.
With version 3.34.2, WP Magic Link Login gives site administrators full control over how passwordless authentication works on their WordPress site, from link expiration times to IP-based access restrictions and domain-specific login controls.
When a user visits your login page, they simply enter their email address and submit the form. The plugin then sends a secure magic link to that email address. The link has a configurable expiration time that you can set anywhere between 1 and 60 minutes. When the user clicks the link within that window, they are automatically authenticated and directed to your chosen landing page — whether that is their profile page, a custom URL, or an internal page of your site.
Traditional password-based authentication creates significant security vulnerabilities. Users rarely choose strong passwords, often reuse them across multiple sites, and fall victim to credential stuffing and brute-force attacks. WP Magic Link Login eliminates these risks by removing passwords from the equation entirely.
The plugin adds multiple layers of protection. Magic links expire automatically within a timeframe you control, limiting the window of opportunity for unauthorized access. IP address restriction ensures that even if a magic link is intercepted, it can only be used from the original requesting IP address. Domain-based restrictions let you lock your site down so only users with approved email addresses — such as company employees — can authenticate.
Small businesses and internal portals: If you run a business website and want only employees to log in, restrict access to email addresses ending with your company domain. This ensures that only authorized staff members can create accounts and access your site.
Membership sites: Offer a smoother login experience for registered members who do not want to remember another password. The magic link approach reduces friction and eliminates password-related support requests.
Guest access scenarios: Allow visitors to log in without first going through a registration process. When a guest requests a magic link, the plugin automatically creates an account using their email address, streamlining the onboarding flow.
WP Magic Link Login offers a practical solution to one of the most common security weaknesses on WordPress sites — weak or reused passwords. By replacing password-based login with secure, time-limited magic links, you reduce your site’s exposure to brute-force attacks and credential stuffing without adding friction to the user experience.
The plugin is highly configurable, letting you tailor the passwordless login flow to your specific needs. Whether you want to replace the default login form entirely, restrict access to a company domain, or simply add an alternative login method for convenience, WP Magic Link Login gives you the flexibility to do so.
The GPL license means you can use the plugin across unlimited domains, and lifetime updates ensure you stay current with the latest features and security improvements.
It can, but it does not have to. You can choose to display the magic link form below the default WordPress login form or disable the default form entirely and show only the magic link form.
Yes. You can configure the expiration time for magic links anywhere between 1 and 60 minutes.
Yes. You can allow guests to request a magic link. When they do, a new account is automatically created using the email address they submitted.
Yes. You can restrict login to specific email domains, such as only allowing users with addresses ending in your company’s domain (for example, @yourcompany.com).
The plugin is distributed under the GPL license, which allows unlimited domain usage. It also includes lifetime updates.
WP Magic Link Login is a straightforward, feature-rich solution for WordPress site owners who want to strengthen their site’s security by eliminating password-based authentication. With configurable expiration times, IP and domain restrictions, customizable email settings, and flexible display options, this plugin adapts to a wide range of use cases — from internal business portals to public-facing membership sites. Available under a GPL license with lifetime updates, it offers lasting value for protecting your WordPress site.
WP Magic Link Login lets users log in to your WordPress site without passwords. After submitting their email address, they receive a secure, time-limited login link. Protect your site with IP restrictions, domain controls, and customizable settings — all under a GPL license with lifetime updates.Secure passwordless login via email magic linksConfigurable link expiration from 1 to 60 minutesIP address and domain-based login restrictionsOption to replace or supplement the default WordPress login formAllow registered users only or enable guest account creationCustomizable email subject, sender, and contentGPL license with unlimited domain usage and lifetime updates
