Getting Started
Magic Link Settings Reference: Every Option, Default, and Tab
All Magic Link options live in one place: Magic Link → Settings. Since version 2.3.0 the screen has a sidebar with one tab per area. This page lists every option, what it does by default, and which guide to read next. Options marked PRO only appear when Magic Link PRO is active.
Click Save Changes after editing. Changes apply as soon as they are saved.
Tabs at a glance
| Tab | Free | PRO |
|---|---|---|
| General | Yes | Adds more fields |
| Branding | Yes | Yes |
| Reports | Yes (Email Digest) | Yes |
| PRO | ||
| Integrations | PRO | |
| Security | PRO |
General tab
| Option | Default | What it does | Guide |
|---|---|---|---|
| Enable Magic Link | On | Master switch. When off, passwordless login, the login-screen redirect, and the shortcode and block flows stop working. | Getting started |
| Force Magic Link Login | Off | Redirects wp-login.php to the Magic Link form, so the password form is no longer shown. |
Force Magic Link login |
| Token Lifespan | 5 Minutes | How long a link stays valid. Accepts 1 to 1440 minutes, or the equivalent in Hours or Days. | Expiry settings |
| Token Validity | 1 | How many times one link can be used. | Expiry settings |
| Show on Login Form | Off | Adds a Send me the Magic Link button under the standard WordPress login form. Ignored visually when Force Magic Link Login is on. | Login from WordPress |
| Login Redirect | Your site's home URL | Where users land after signing in. Clear it to use WordPress's role-based defaults. PRO replaces it with a default URL plus a per-role table, and adds Default Role for New Users and Outgoing Emails (below). | Redirect after login |
| Default Role for New Users PRO | (none) | Role given to accounts created by Magic Link (for example by registration). If empty, the role from WordPress Settings → General is used. | Trusted domains |
| Outgoing Emails PRO | Off | Adds a magic-link block to the emails your site sends. Includes Link Text (default Log in to your account instantly). | Insert a Magic Link into emails |
Branding tab
| Option | Default | What it does |
|---|---|---|
| Logo | WordPress logo | Replaces the WordPress logo on the login screen, in the magic-link email, and on the Confirm sign-in screen. |
| Show Logo On | All three | Tick where the logo appears: Login screen, Magic Link email, Confirm sign-in screen. |
| Primary Colour | (theme default) | Colour for the login button and links. Accepts 3 or 6 digit hex values. |
| Custom CSS | (empty) | Extra CSS for the login screen. Style tags and script-like values are stripped. |
See Brand your login screen and emails.
Reports tab
Email Digest settings. See Email digest reports.
| Option | Default | What it does |
|---|---|---|
| Enable Email Digest | Off | Sends a periodic summary of magic-link activity by email. |
| Digest Frequency | Weekly | Daily, Weekly, or Monthly. |
| Digest Day | 1 | Day of the week (weekly) or month (monthly, 1 to 28). Hidden for daily digests. |
| Send Time | 14:00 | Time of day in your site timezone. |
| Recipients | (empty) | One email address per line. |
| Digest Status | n/a | Shows whether the digest is scheduled. |
Email tab (PRO)
| Option | Default | What it does |
|---|---|---|
| Email Subject | Your Magic Link for {site_name} |
Subject line of the sign-in email. |
| Email Body | A button and fallback link | Visual editor for the email. Available merge tags: {site_name}, {user_name}, {user_email}, {magic_link}, {expiry_time}, and {expiry_unit}. |
See Customize the Magic Link email.
Integrations tab (PRO)
One switch per supported plugin (WooCommerce, WooCommerce Subscriptions, Easy Digital Downloads, MemberPress, Paid Memberships Pro, LearnDash, LifterLMS, Tutor LMS, bbPress, FluentCRM, WP Fusion, WPForms, Gravity Forms, Fluent Forms), each showing whether that plugin is detected. Switching an integration on can reveal its own sub-tab. See the guides under Integrations in the sidebar.
Security tab (PRO)
| Section | Defaults | Guide |
|---|---|---|
| IP Check: link must be used from the IP that requested it | Off | Restrict by IP |
| Client IP Source: how the visitor IP is read (direct, Cloudflare, X-Forwarded-For, X-Real-IP) | Direct connection | Restrict by IP |
| Brute Force Protection: ban an IP after failed logins | Off. Ban 60 minutes after 10 failures in 5 minutes | Stop brute force |
| Login Request Throttling: cap link requests per IP | Off. 10 requests per 15 minutes | Throttle requests |
| Domain Restriction: Allowed Domains and Blocked Domains | Off | Approved domains |
| Trusted Domains: Enable Trusted Domains, domain list, New User Role | Off. New user role Subscriber | Trusted domains |
| Access Control: IP Allow List, Country Allow List, Time Window | All empty (everything allowed) | Restrict when links work |
Country Allow List needs a provider
Filling in the Country Allow List without a geolocation provider blocks every login. Read Restrict when Magic Links work before using it.
Things that are not on the Settings screen
A few behaviours are controlled in other places:
- Scanner protection (Confirm sign-in page) is always on by default and has no switch on the Settings screen.
- Resend cooldown (30 seconds per email address on the shortcode and block forms) is changed with the
kc_ml_resend_cooldownfilter. See Hooks and filters reference. - Username-only login is enabled by defining
MAGIC_LINK_USERNAME_ONLYastrueinwp-config.php. The login form then asks for a username only and email addresses are not accepted. - Registration checkbox on the shortcode form depends on the
magic_link_enable_registrationoption, which has no settings field. - Link usage limits (PRO) are chosen when a link is created. See Limit how many times a link can be used.