Restrict Magic Link Login to Approved Email Domains

Q: Is Domain Restriction free?

No. Domain Restriction lives on the Security tab, which is a Magic Link PRO feature. The entire Security tab — including Domain Restriction, Trusted Domains, and Access Control — requires a PRO license. The free version does not include email-domain allow or block lists.

Q: What happens if I leave the Allowed Domains list empty?

An empty Allowed Domains list allows every domain to request a Magic Link. The allow-list only starts restricting access once you add at least one domain to it. Your Blocked Domains list still applies either way, refusing any domain you list there.

Q: How do I enter multiple domains?

Enter one domain per line in the Allowed Domains or Blocked Domains textarea. Use the bare domain, such as company.com or school.edu, without http:// or an @ symbol. Save your changes and the lists take effect on the next Magic Link request.

Q: What is the difference between Domain Restriction and Trusted Domains?

Domain Restriction controls who is allowed to request a link — it refuses domains that are not approved. Trusted Domains does the opposite for onboarding: it lets people on a trusted domain get a link and auto-creates a WordPress account for them if none exists. They are separate settings and can be used together.

Want only people at your company or organization to request a Magic Link? Domain Restriction lets you limit passwordless login to approved email domains. Keep an allow-list of domains that may request a link, a block-list of domains that never can, or both. Requests from any other domain are refused before an email is sent.

PRO feature

Domain Restriction is part of the Security tab, which is available in Magic Link PRO. The entire Security tab and its settings require a PRO license.

What is Domain Restriction?

Domain Restriction is a Magic Link PRO control that decides which email domains are allowed to request a passwordless login link. It checks the domain of the requesting email address against your lists and refuses anything that is not approved, so unwanted addresses never receive a link.

How to restrict Magic Link to approved domains

In WordPress admin, go to Magic Link → Settings → Security.
Find the Domain Restriction section and turn its Enable switch on.
In Allowed Domains, enter the domains that may request a link — one domain per line, for example company.com or school.edu.
In Blocked Domains, enter any domains that must always be refused — again, one per line.
Save your changes.

Allowed Domains vs Blocked Domains

The two lists work together. Use one or both depending on how tightly you want to control access.

Field	Behavior
Allowed Domains	Acts as an allow-list. Only these domains can request a Magic Link; everything else is refused. Leaving it empty allows all domains.
Blocked Domains	Acts as a block-list. These domains are always refused, even if they would otherwise be allowed.

Enter one domain per line in each textarea. If a domain appears on both lists, the block-list wins and the request is refused.

What the user sees

If someone requests a link from an approved domain, the flow continues normally and the email is sent. If the domain is not on the allow-list (or is on the block-list), the request is refused before any email goes out, so the address never receives a link.

Example

If company.com is on the Allowed Domains list, then alex@company.com can request a Magic Link, but alex@gmail.com cannot. Add gmail.com to Blocked Domains and that domain is refused even if you later widen the allow-list.

When to use it

Domain Restriction fits sites built for a defined group of people:

Company portals and employee dashboards
Private communities and membership sites
Organization or school websites
Any site where you want to cut spam login requests

Conclusion

Domain Restriction gives you a simple gate on who can request a passwordless login: an allow-list, a block-list, or both. If you also want people on trusted domains to log in without an existing account, pair it with Trusted Email Domains that skip account creation.

FAQs

Is Domain Restriction free?

No. Domain Restriction lives on the Security tab, which is a Magic Link PRO feature. The entire Security tab — including Domain Restriction, Trusted Domains, and Access Control — requires a PRO license. The free version does not include email-domain allow or block lists.

What happens if I leave the Allowed Domains list empty?

An empty Allowed Domains list allows every domain to request a Magic Link. The allow-list only starts restricting access once you add at least one domain to it. Your Blocked Domains list still applies either way, refusing any domain you list there.

How do I enter multiple domains?

Enter one domain per line in the Allowed Domains or Blocked Domains textarea. Use the bare domain, such as company.com or school.edu, without http:// or an @ symbol. Save your changes and the lists take effect on the next Magic Link request.

What is the difference between Domain Restriction and Trusted Domains?

Domain Restriction controls who is allowed to request a link — it refuses domains that are not approved. Trusted Domains does the opposite for onboarding: it lets people on a trusted domain get a link and auto-creates a WordPress account for them if none exists. They are separate settings and can be used together.

Does a blocked domain still receive an email?

No. When a request comes from a blocked domain, or from a domain not on your allow-list, Magic Link refuses it before sending anything. No email is generated, so the address never receives a login link.