Skip to content

Getting Started

Magic Link Setup: Passwordless Email Login for WordPress

Want passwordless login in WordPress without writing code? Magic Link lets users sign in with a secure link sent to their email instead of a password. Install the plugin, enable it in Magic Link → Settings → General, add the button to your login form, and test a sign-in in a few minutes. Magic Link is email-based: every sign-in link is delivered by email.

Magic Link is a WordPress plugin that adds passwordless, email-based login to your site. A user enters their username or email, receives a one-time sign-in link by email, and clicks it to log in. All the core login features covered on this page are free.

Install and Activate

  1. In WordPress admin, go to Plugins → Add New.
  2. Search for Magic Link.
  3. Click Install Now, then Activate.

After activation, a Magic Link item appears in the admin menu.

Basic Setup

  1. Go to Magic Link → Settings → General.
  2. Turn on Enable Magic Link (on by default).
  3. Set Token Lifespan — a number plus a unit (Minutes, Hours, or Days) that controls how long a link stays valid. The default is 5 minutes; the accepted range is 1–1440 minutes.
  4. Set Token Validity — how many times a single link may be used. The default is 1 (single-use).
  5. Turn on Show on Login Form so a magic-link button appears on wp-login.php.
  6. Click Save.

First Test

  1. Open your site login page at /wp-login.php.
  2. Click the magic-link button.
  3. Enter your username or email address.
  4. Open your inbox and click the sign-in link.
  5. On the "confirm it's you" page, confirm to complete sign-in.

If the login succeeds, your setup is complete. The confirmation step is Intent Confirmation, a free protection that is on by default and stops email scanners from consuming a one-time link before the user clicks it.

Next Steps

Conclusion

You now have passwordless email login running in WordPress: the plugin is active, magic links are enabled, and a button on your login screen lets users sign in without a password. From here, learn how email magic-link login works, add a login form anywhere with the shortcode, or explore the free vs PRO features. If a link never arrives, see Troubleshooting.

FAQs

Yes. Core passwordless email login is free, including Enable Magic Link, Token Lifespan, Token Validity, Show on Login Form, a single login redirect, and Intent Confirmation scanner protection. Paid PRO plans add email template customization, security controls, integrations, a REST API, and webhooks. You can set up and test passwordless login entirely on the free version.

Do users still need a password?

No. Once Magic Link is enabled, a user can request a sign-in link by email and log in by clicking it, without typing a password. The standard username and password form still appears alongside the magic-link button unless you turn on Force Magic Link Login, which makes the magic link the default method.

By default a link is valid for 5 minutes and can be used once. You control both in Magic Link → Settings → General: set Token Lifespan to a number plus a unit (Minutes, Hours, or Days, with a 1–1440 minute range) and set Token Validity to the number of times a link may be used.

No. In the current version Magic Link delivers every sign-in link by email only. There is no SMS or QR-code login in the plugin. If a user does not receive their link, check spam and your site's email delivery, then see Troubleshooting.

What is the "confirm it's you" page?

It is Intent Confirmation, a free feature that is on by default. When a user clicks a magic link, a short confirmation page appears before sign-in completes. This prevents automated email scanners, such as Outlook Safe Links, Mimecast, and Proofpoint, from silently consuming the one-time link before the real user opens it.

Was this page helpful?

Next
Login from the WordPress login screen