Security (PRO)
Control When and Where Magic Links Work (Access Control)
A magic link stays valid until it expires, so a forwarded email or an open laptop can log someone in at 3am on a Sunday when nobody is watching. Access Control closes that gap by adding rules for when and where a link may be used: a Time Window (dates, weekdays, and hours), an IP Allow List, and a Country Allow List. Attempts outside your rules are refused automatically.
PRO feature
Access Control is part of the Security tab, which is available in Magic Link PRO. The entire Security tab and its settings require a PRO license.
What is Access Control?
Access Control is a group of Magic Link PRO settings under Magic Link → Settings → Security → Access Control. It lets the site enforce login rules on your behalf — a link only works during allowed hours, from allowed networks, or from allowed countries — whether or not you are paying attention.
Time Window: restrict which dates, days, and hours links work
Under Time Window you can limit logins to a date range, specific weekdays, and hours of the day.
| Setting | What it does |
|---|---|
| Valid From | No magic link works before this date. |
| Valid Until | No magic link works after this date. |
| Allowed Days | Tick the weekdays (Mon–Sun) on which logins are allowed. Leave every day unticked to allow all of them. |
| Start Hour | Earliest hour of the day a link may be used, 0–23. |
| End Hour | Latest hour of the day a link may be used, 0–23. |
Every field is optional. Leave them all empty and magic links work at any time, exactly as before. Fill in only the ones you care about — an end date with no hour restriction is perfectly normal.
Set a business-hours window
- Go to Magic Link → Settings → Security → Access Control.
- Under Allowed Days, tick Monday through Friday.
- Set Start Hour to
9. - Set End Hour to
17. - Leave Valid From and Valid Until empty.
- Save your changes.
Magic links now work on weekdays between 09:00 and 17:59 and are refused at every other time.
Windows that cross midnight
If End Hour is lower than Start Hour, the window wraps to the next day. Start 22, end 2 means 22:00 through 02:59 — useful for overnight shifts.
Times are evaluated in UTC
Dates and hours are evaluated in UTC, not your site's local timezone. If your site runs several hours away from UTC, convert before you enter the values. A team working 9–5 in UTC+5:30 should enter roughly 3 to 12, not 9 to 17. Set the window, then have someone test a login at the edge of it before you rely on it.
IP Allow List: restrict which networks links work from
The IP Allow List accepts logins only from the addresses or ranges you list. Enter one IPv4 or IPv6 address or CIDR range per line, for example 203.0.113.4 or 10.0.0.0/24. An empty list allows every address, so the feature is off until you add an entry.
This is the strongest access control and also the easiest to lock yourself out with. For the full setup, the same-IP IP Check option, and lockout warnings, see restrict Magic Link logins by IP address.
Country Allow List: restrict which countries links work from
The Country Allow List accepts two-letter country codes such as US, GB, IN, and refuses logins from anywhere else. Like the IP list, an empty value allows all countries.
Requires a geolocation provider
The Country Allow List needs a geolocation provider connected before it does anything. Magic Link does not ship with an IP-to-country database, so on a standard install no country can be resolved and this setting stays inactive. A developer can connect a provider through the kc_ml_geoip_resolver filter.
If you want country restriction and do not have a developer available, contact support and ask about the current options before relying on it.
What the user sees
When someone opens a link outside your rules — wrong time, wrong network, or wrong country — they are not logged in. They see a short message explaining that the link is not allowed under the current conditions, and the link stays unused, so they can try again once conditions are met.
Conclusion
Access Control lets the site refuse out-of-hours, off-network, and out-of-country logins automatically, without you revoking links by hand. Combine a Time Window with an IP allow list, and cap reuse with a usage limit for defense in depth.
FAQs
Is Access Control free?
No. Access Control sits on the Security tab, which is a Magic Link PRO feature. Time Window, IP Allow List, and Country Allow List all require a PRO license. The free version does not include time, network, or country restrictions on magic links.
What timezone are the Time Window hours in?
All Time Window dates and hours are evaluated in UTC, not your WordPress site timezone. Convert your local hours to UTC before entering them, then test a login at the edge of the window to confirm the range behaves as expected for your users.
Why does my Country Allow List do nothing?
The Country Allow List needs a geolocation provider connected through the kc_ml_geoip_resolver filter. Magic Link ships without an IP-to-country database, so with no provider it cannot resolve a country and the setting stays inactive. Add a provider, or contact support about current options.
What happens if I leave every Access Control field empty?
Nothing is restricted. An empty Time Window, empty IP Allow List, and empty Country Allow List all mean "allow everything," so magic links work at any time, from any network, and from any country — exactly as they did before you enabled the Security tab.
Can I combine time, IP, and country rules?
Yes. The three Access Control settings apply together. A login must satisfy all of the rules you have set — for example, be within the time window and from an allowed IP and from an allowed country. Any rule left empty simply allows everything for that dimension.