Security (PRO)
Restrict Magic Link Logins by IP Address
Email is not a secure channel — a magic link that reaches the wrong inbox is a working key to your site. Magic Link PRO gives you two IP-based defenses: IP Check, which forces a link to be opened from the same IP that requested it, and the IP Allow List, which accepts logins only from networks you approve. Use either or both to keep forwarded and leaked links from working elsewhere.
PRO feature
IP Check and the IP Allow List live on the Security tab, which is available in Magic Link PRO. The entire Security tab and its settings require a PRO license.
IP Check vs IP Allow List
The two controls solve related but different problems. You can enable one, the other, or both.
| Control | Where | What it does |
|---|---|---|
| IP Check | Magic Link → Settings → Security | Requires the link to be opened from the same IP address that requested it. No list to maintain — it simply ties each link to its requester's network. |
| IP Allow List | Magic Link → Settings → Security → Access Control | Accepts logins only from a fixed set of addresses or CIDR ranges you define. Everything outside the list is refused. |
Use IP Check to stop a link working after it is forwarded to a different network, without deciding which networks are valid in advance. Use the IP Allow List when logins should only ever come from known networks, such as your office or VPN.
Turn on IP Check (same-IP enforcement)
- Go to Magic Link → Settings → Security.
- Turn the IP Check switch on. It is off by default.
- Save your changes.
Now a magic link only works from the same IP address that requested it. If the requester moves networks — or forwards the email to someone elsewhere — the link is refused.
Set up an IP Allow List
- Find the public IP address you log in from. Searching "what is my IP" in a browser will tell you.
- Go to Magic Link → Settings → Security → Access Control.
- Enter one address or range per line in IP Allow List:
203.0.113.4
10.0.0.0/24
2001:db8::/32
- Save your changes.
- Test immediately, in a private window, before you close the settings screen.
An empty list allows every address. That is the default, and it means the feature is off until you deliberately turn it on.
Single addresses and ranges
- A plain address —
203.0.113.4— allows exactly that one machine. - A CIDR range —
10.0.0.0/24— allows every address in that block, which is how you allow a whole office.
Both IPv4 and IPv6 are supported. If you are not sure which range your office uses, your IT provider or network administrator can tell you. Entries that are not valid addresses or ranges are dropped when you save — if a line disappears after saving, that line was malformed.
Do not lock yourself out
If you add an allow list that does not include your own address, magic link logins stop working for you as well. Protect yourself before you save:
- Know your normal password login. The allow list applies to magic link logins only. A standard WordPress username and password login still works, so keep those credentials handy.
- Home connections change. Most home broadband uses a dynamic IP that changes every few days. Allow-listing today's address will lock you out later in the week. Use a range from your provider, a VPN with a fixed address, or skip this feature for home users.
- Mobile networks move constantly. If people log in from phones, an IP allow list is almost certainly the wrong tool. Consider a time window instead.
What the user sees
Someone opening a link from a blocked address is not logged in. They see a short message saying their IP is not allowed to use this magic link. The link is not consumed, so it still works from an allowed address.
Conclusion
IP Check and the IP Allow List are the strongest of Magic Link's access controls — and the easiest to lock yourself out with, so always test after saving. To also limit when and from which country links work, see the other Access Control settings, and to block addresses that repeatedly fail, see stop brute-force attacks.
FAQs
Is IP restriction free?
No. Both IP Check and the IP Allow List are on the Security tab, which is a Magic Link PRO feature. The whole Security tab — including Access Control — requires a PRO license. The free version does not restrict magic-link logins by IP address.
What is the difference between IP Check and the IP Allow List?
IP Check forces each link to be opened from the same IP that requested it, with no list to maintain. The IP Allow List refuses every login except from a fixed set of addresses or ranges you define. IP Check follows the requester; the allow list is a pre-set network whitelist. You can enable both.
Will an IP allow list lock me out?
It can. If your own address is not on the list, your magic-link logins are refused too. Standard WordPress username-and-password login still works, so keep those credentials ready, and always test in a private window right after saving before you close the settings screen.
Does the IP Allow List support ranges and IPv6?
Yes. Enter one entry per line as a single address (203.0.113.4) or a CIDR range (10.0.0.0/24), in either IPv4 or IPv6. A range allows every address in that block — the usual way to allow a whole office. Invalid entries are dropped when you save.
Can I restrict logins by country as well?
Yes, on the same Access Control screen, but the Country Allow List needs a geolocation provider connected through the kc_ml_geoip_resolver filter, or it stays inactive. See Access Control for details on the country and time-window options.