How Can I Allow Magic Link Logins Only From Our Office Network?

Quick Answer

This is a Pro feature. In Magic Link -> Settings -> Security -> Access Control, add your allowed addresses to the IP Allow List. Any magic link opened from an address outside that list is refused.

Why This Helps

Email is not a secure channel. A magic link that reaches the wrong inbox — a forwarded message, a shared mailbox, a compromised account — is a working key to your site.

An IP allow list means the key only turns in the right door:

Internal tools. If staff only ever log in from the office or the company VPN, a login attempt from anywhere else is not a legitimate one.
Forwarded email stops being dangerous. Someone can pass the message on, but the link will not work from their network.
Compromised inboxes lose most of their value. An attacker with the email still needs to be on your network to use it.

This is the strongest of the access controls, and also the easiest one to lock yourself out with. Read the warning below before you switch it on.

How To Set Up An Allow List

Find the public IP address you log in from. Searching for "what is my IP" in a browser will tell you.
Go to Magic Link -> Settings -> Security -> Access Control.
Enter one address or range per line in IP Allow List:

203.0.113.4
10.0.0.0/24
2001:db8::/32

Save changes.
Test immediately, in a private window, before you close the settings screen.

An empty list allows every address. That is the default, and it means the feature is off until you deliberately turn it on.

Do Not Lock Yourself Out

If you add an allow list that does not include your own address, magic link logins stop working for you as well.

Protect yourself before you save:

Know your normal password login. The allow list applies to magic link logins. A standard WordPress username and password login still works, so keep those credentials handy.
Home connections change. Most home broadband uses a dynamic IP that changes every few days. Allow-listing the address you happen to have today will lock you out later in the week. Use a range from your provider, a VPN with a fixed address, or do not use this feature for home users.
Mobile networks move constantly. If people log in from phones, an IP allow list is almost certainly the wrong tool. Consider time windows instead.

Single Addresses And Ranges

A plain address — 203.0.113.4 — allows exactly that one machine.
A CIDR range — 10.0.0.0/24 — allows every address in that block, which is how you allow a whole office.

Both IPv4 and IPv6 are supported. If you are not sure which range your office uses, your IT provider or network administrator can tell you.

Entries that are not valid addresses or ranges are dropped when you save. If a line disappears after saving, that line was malformed.

Country Allow List

The same screen has a Country Allow List, where you can enter two-letter country codes such as US, GB, IN.

This needs a geolocation provider to be connected before it does anything. Magic Link does not ship with an IP-to-country database, so on a standard install no country can be determined and this setting stays inactive. A developer can connect a provider through the kc_ml_geoip_resolver filter.

If you want country restriction and do not have a developer available, contact support and ask about the current options before relying on it.

What The User Sees

Someone opening a link from a blocked address is not logged in. They see a short message saying their IP is not allowed to use this magic link. The link is not consumed, so it still works from an allowed address.

Restrict when magic links work — control the times logins are allowed.
Restrict to approved email domains — control who can request a link.
Stop brute-force attacks — block addresses that repeatedly fail.