How to Force Magic Link Login on the WordPress Login Page

Make Magic Link the Default WordPress Login

Out of the box, your WordPress login page (wp-login.php) asks for a username and a password. Force Magic Link Login replaces that screen with the Magic Link form: visitors type their username or email address, receive a one-time sign-in link by email, and click it to get in. No password is typed.

This setting is free and off by default. It takes under a minute to turn on, but read Before you turn it on first, because once it is on the standard login form is no longer shown.

Before and after

Before — the default WordPress login screen, with username, password and the Log In button:

After — the same address, wp-login.php, once Force Magic Link Login is on. It now shows the Magic Link form only:

When a visitor opens wp-login.php, Magic Link sends them to wp-login.php?action=magic_link. Anything already in the address, such as the redirect_to value WordPress adds when you open /wp-admin/ while logged out, is kept.

Before you turn it on

Check these four things. They take a few minutes and prevent almost every problem people hit with this setting.

1. Magic Link must be enabled. On Magic Link → Settings → General, Enable Magic Link must be on (it is on by default). If it is off, Force Magic Link Login does nothing.
2. Your site must be able to send email, and you must have proved it. The sign-in link only travels by email. If WordPress cannot deliver email, nobody, including you, can sign in once the password form is hidden. A mail plugin that uses SMTP or a transactional email service is strongly recommended. To test with the setting still off, open a private browser window, go to https://your-site.com/wp-login.php?action=magic_link, enter your own username or email, and confirm the email arrives and the link signs you in. (The Magic Link → Health page only checks that WordPress's mail function exists. It cannot tell you whether messages are actually delivered, so do not rely on it for this.)
3. Every user needs a working email address on their profile. The link is sent to the address saved on the user account.
4. Set up a way back. The Magic Link screen has no password field and no "log in with a password" link. Add the one-line safety snippet in Keep a way back before you enable the setting, and keep the page open in a second browser window while you test.

How to enable Force Magic Link Login

1. In the WordPress admin, go to Magic Link → Settings. The General tab opens first.
2. Find Force Magic Link Login (helper text: Use magic link login by default.) and switch it on.
3. Click Save Changes. The change applies as soon as it is saved.

4. Test it in a private window. Open a private or incognito window (so you are not already logged in), go to https://your-site.com/wp-login.php, and confirm you land on the Magic Link form shown above. Enter your own username or email address and complete the sign-in described below.

To go back, switch Force Magic Link Login off and save. The standard login form returns immediately.

What your users see

Once the setting is on, every user signs in the same way:

1. They open the login page and see the Magic Link form. The message above the field reads "Please enter your username or email address. You will receive an email message to log in."

2. They enter their username or email address and click Send me the Magic Link.

3. They are told to check their inbox: "Please check your inbox for the login link. If you did not receive a login email, check your spam folder too."

   

4. They open the email and click the Login to [your site name] button (or paste the link into the browser). By default the email is titled Your Magic Link for [site name] and the link is valid for 5 minutes and works once. You can change both under Magic Link → Settings → General (Token Lifespan and Token Validity), see Magic Link expiry settings.

   

5. They confirm the sign-in. A short Confirm sign-in page asks them to click Continue to log in. This step is deliberate: it stops email security scanners from opening and using up the one-time link before the person does. Read more in Email magic-link login.

   

6. They are logged in and sent to your Login Redirect page (see Where users land after login).

What changes, and what does not

Force Magic Link Login changes which screen is shown at wp-login.php. It does not remove passwords from WordPress.

Situation	What happens with Force Magic Link Login on
Visitor opens wp-login.php	Redirected to the Magic Link form (?action=magic_link)
Logged-out visitor opens /wp-admin/	Sent to the login page and then to the Magic Link form. The original destination is kept in the address
Lost your password? page (?action=lostpassword)	Not affected. Still opens normally if you link to it
Password accounts and passwords	Not removed or disabled. Users still have a password stored; the form is just not shown
People who are already logged in	Not logged out. Existing sessions continue
Other login forms (a WooCommerce My Account page, a page with the [magic_link_form] shortcode, a theme's custom form)	Not changed. Only the standard wp-login.php screen is affected
Failed or direct password submissions to wp-login.php	Still processed by WordPress. Force Magic Link Login only redirects page views, not form submissions

Force Magic Link Login vs. Show on Login Form

Magic Link has two ways to offer passwordless login on wp-login.php. Pick the one that matches how firmly you want to move users off passwords.

	Force Magic Link Login	Show on Login Form
Where	Magic Link → Settings → General	Magic Link → Settings → General
Password form still visible?	No. Magic Link form only	Yes. Password form stays, with a Send me the Magic Link button added below it
Best for	Sites that want everyone passwordless (members, customers, clients)	A gentle roll-out where some users still prefer passwords
Both switched on	Force Magic Link Login wins. Users see the Magic Link form only

This is what Show on Login Form looks like (Force Magic Link Login off):

If you are not sure, start with Show on Login Form for a week or two, then switch to Force Magic Link Login once people are used to it.

Where users land after login

After a Magic Link sign-in, the user is sent to the URL in Login Redirect (same General tab). On a fresh install this field is pre-filled with your site's home URL, so everyone, including administrators, lands on the home page.

• To send people to specific pages, enter that URL in Login Redirect. See Redirect after Magic Link login.
• To use WordPress's own defaults instead, clear the field and save. Anyone who can edit posts (administrators, editors, authors) then lands on the Dashboard, and users who cannot, such as Subscribers, land on their Profile page.
• With PRO, you can set different pages per role.

Keep a way back

With the setting on, a site owner whose email stops working cannot sign in through the normal screen. Add this safety net before you enable the setting.

Magic Link provides a filter, magic_link_before_login_form_redirect. If anything hooked to it returns a value other than null, the redirect is skipped and WordPress shows its normal login form. The snippet below does that only when a secret word is in the address:

add_filter( 'magic_link_before_login_form_redirect', function ( $skip ) {
	if ( isset( $_GET['classic'] ) && 'change-this-secret-word' === $_GET['classic'] ) {
		return true; // Any value other than null skips the redirect.
	}
	return $skip;
} );

Where to put it (choose one):

1. Best: save it as a new file wp-content/mu-plugins/magic-link-classic-login.php, starting with <?php on the first line. Create the mu-plugins folder if it does not exist. Files here load automatically and survive theme and plugin updates.
2. Or add it to the end of your child theme's functions.php. Do not use a parent theme: a theme update will erase it.

Then change change-this-secret-word to your own word. To use the standard password form, open:

https://your-site.com/wp-login.php?classic=change-this-secret-word

If you are already locked out

Work through these in order:

1. Request a link anyway. Enter your username or email on the Magic Link form. If the email arrives, you are in. If it does not, check spam, then fix email sending (SMTP or mail plugin settings).

2. Turn the setting off from the database, using WP-CLI, if you have command-line access:

   wp eval '$o = get_option( "kc_ml_settings" ); $o["general"]["settings"]["force_magic_link_login"] = 0; update_option( "kc_ml_settings", $o );'
   

   The standard login form returns immediately.

3. Pause the plugin from the file system. In your host's File Manager or over SFTP, rename wp-content/plugins/magic-link to magic-link-off. WordPress deactivates the plugin and the normal login form returns. Log in, rename the folder back, and re-activate Magic Link.

Troubleshooting

I turned it on, but I still see the password form.

• Check that Enable Magic Link is on. Force Magic Link Login only works while Magic Link itself is enabled.
• Check that you saved. Look for the success message at the top of the screen.
• Clear any page or server cache for wp-login.php, and test in a private window.
• If a custom filter returns a value for magic_link_before_login_form_redirect, such as the safety snippet above with the secret word in the address, it skips the redirect.
• If you use a plugin that moves or renames the login page, check that it still uses the core wp-login.php screen. Force Magic Link Login only acts on that screen.

The email never arrives. Check your spam folder first. Then confirm your WordPress email is configured for reliable sending (an SMTP or transactional-email plugin is the usual fix). The Magic Link → Health page only checks that WordPress's mail function exists, so a passing Health result does not prove delivery. More help in Troubleshooting.

The link says it is invalid or expired. Links last 5 minutes and work once by default. Request a new one. If the person clicks a link twice, the second click fails by design.

FAQs

Is Force Magic Link Login free?

Yes. It is part of the free Magic Link plugin, with no PRO licence required. It is off by default.

Does it stop people using passwords?

No. It stops the password form from being shown at wp-login.php. Passwords are not deleted or disabled, and form submissions to wp-login.php are still handled by WordPress. If you need to block password logins entirely, use a dedicated security plugin or custom code in addition to this setting.

Can I force Magic Link login for only some users or roles?

Not in the current release. The setting applies to the whole login page, so it affects every user, including administrators. Limiting Magic Link by role is not available yet. To offer both methods, use Show on Login Form instead.

Will administrators be affected too?

Yes. Administrators see the same Magic Link form. That is why it is important to confirm email delivery and set up the safety snippet first.

Do the sign-in links still expire?

Yes. Every link follows Token Lifespan (5 minutes by default) and Token Validity (1 use by default). Forcing Magic Link does not change either. See Magic Link expiry settings.

Does this change the lost-password screen or registration?

No. Only the standard login view is redirected. The lost-password screen is untouched.

Can I make it default on a custom login page instead of wp-login.php?

Force Magic Link Login works on wp-login.php only. For a custom page, add the form with the shortcode or the login form block.

Where is the setting?

Magic Link → Settings → General → Force Magic Link Login. Switch it on and click Save Changes.

Conclusion

Force Magic Link Login turns wp-login.php into a passwordless sign-in page in three clicks. Confirm that your site can send email, add the safety snippet, switch the setting on and test it in a private window. Then decide where people land with Redirect after Magic Link login, and tune how long links last in Magic Link expiry settings.