Skip to content

Getting Started

Let Users Log In With Email Magic Links Instead of Passwords

Tired of password resets and login friction on your WordPress site? Magic Link lets users sign in with a secure, one-time link sent to their email instead of a password. Turn on Enable Magic Link and Show on Login Form in Magic Link → Settings → General, and users can request a sign-in link right from the login screen. This is a free feature.

Login Without Entering a Password

Magic Link sends a secure sign-in link to a user's email address. The user clicks the link to log in without typing a password. Every link is single-use by default and expires after a set time, so it works like a one-time password delivered by email.

Why It Helps

Passwordless email login removes the most common source of login trouble. It is especially useful when you want to:

  • Reduce password reset requests
  • Make login easier for non-technical users
  • Support mobile-friendly login flows
  • Keep authentication simple and secure

How to Enable

  1. Go to Magic Link → Settings → General.
  2. Turn on Enable Magic Link (on by default).
  3. Turn on Show on Login Form so users can request a link from wp-login.php.
  4. Click Save.

Email subject and body customization is available under Magic Link → Settings → Email.

PRO feature

Editing the magic-link email subject and body (the Email tab) is a PRO feature. On the free version, Magic Link sends a fixed default email. Login-screen and email branding — logo, colour, and custom CSS — is free. See Free vs PRO features.

How the Flow Works

  1. A user enters their username or email address.
  2. Magic Link sends a secure login link to that email address.
  3. The user opens the email and clicks the link.
  4. A short "confirm it's you" page appears (Intent Confirmation) to prevent email scanners from consuming the one-time link.
  5. The user confirms and is signed in.

Email Magic Link Login

Conclusion

With Magic Link enabled, users sign in by clicking a secure email link instead of remembering a password, which cuts login friction and reduces password reset requests. Add the button to your WordPress login screen or drop a shortcode login form on any page. New to the plugin? Start with the setup guide.

FAQs

A user enters their username or email address on the login screen and requests a magic link. Magic Link emails them a secure, one-time sign-in link. They open the email, click the link, confirm on a short "confirm it's you" page, and are signed in — without ever entering a password.

Yes. Core passwordless email login is free, including Enable Magic Link, Show on Login Form, token lifespan and validity controls, and Intent Confirmation scanner protection. Customizing the email subject and body is a PRO feature, but the free version sends a working default email out of the box.

Yes. Each link is single-use by default and expires after a time you set (5 minutes by default). Intent Confirmation, on by default, adds a confirmation step that blocks automated email scanners from consuming the link. PRO plans add further controls such as IP checks, brute-force protection, and request throttling.

Why does a "confirm it's you" page appear?

That page is Intent Confirmation, a free feature that is on by default. Because a magic link is single-use, email security scanners such as Outlook Safe Links, Mimecast, and Proofpoint can silently open it and use it up. The confirmation step ensures a real person, not a scanner, completes the sign-in.

You can brand the login screen and email — logo, primary colour, and custom CSS — on the free version. Editing the email subject and body text is a PRO feature under Magic Link → Settings → Email. See Customize the Magic Link email for details.

Was this page helpful?

Next
Add a login form with a shortcode