Security (PRO)
Slow Down Repeated Magic Link Login Requests
If a person or a bot keeps asking for new login links, your site sends a flood of emails and takes on needless load. Magic Link slows this down in two layers: every version enforces a free 30-second resend cooldown on the login form, and Magic Link PRO adds Login Request Throttling that caps how many link requests a single IP address can make inside a time window.
Resend cooldown (Free)
After a Magic Link is requested, the login form makes the same email address wait 30 seconds before it can request another link. This stops accidental double-sends and rapid repeats out of the box, with nothing to configure.
The cooldown is measured per email address on the request form. Developers can change the wait with the kc_ml_resend_cooldown filter, which returns the cooldown window in seconds.
Login Request Throttling (PRO)
PRO feature
Login Request Throttling is part of Magic Link PRO. The free resend cooldown above still applies on every site.
Throttling limits how many link requests one IP address can make in a set period. Because it counts per IP rather than per email, it also stops a single source cycling through many different addresses.
- Go to
Magic Link → Settings → Security. - Open Login Request Throttling and turn on Enable throttling.
- Set Max requests — how many link requests are allowed from one IP (default
10). - Set Time window — the number of minutes those requests are counted over (default
15). - Save the settings.
Once an IP passes the limit inside the window, further requests are refused until the window resets.
Settings reference
| Setting | Default | What it does |
|---|---|---|
| Enable throttling | Off | Turns per-IP request throttling on. |
| Max requests | 10 |
The most link requests one IP may make within the window. |
| Time window | 15 minutes |
The period requests are counted over before the count resets. |
The configured sentence reads: "Allow a maximum of {max_requests} login link requests from the same IP within {time_window} minutes."
Cooldown vs throttling
| Resend cooldown (Free) | Login Request Throttling (PRO) | |
|---|---|---|
| Counts by | Email address | IP address |
| Limit | One request per 30 seconds | Max requests per time window |
| Configurable | Via the kc_ml_resend_cooldown filter |
In the admin, under Settings → Security |
| Stops | Accidental double-sends and rapid repeats | An IP cycling through many addresses |
Why it matters
Without throttling, a user or bot can keep asking for new login links again and again, which leads to too much email traffic, extra load on your site, and unnecessary support requests. Throttling is most useful on busy websites, membership portals, and support-heavy sites.
Conclusion
The free resend cooldown handles casual repeats, and PRO Login Request Throttling adds a per-IP cap for abusive traffic. Set the throttling limits to match how often your real users legitimately request a link. To block an IP outright after repeated failed logins, see Stop brute force attacks on Magic Link logins.
FAQs
Does Magic Link limit repeated login requests by default?
Yes. Every version enforces a 30-second resend cooldown on the login form, so the same email address must wait 30 seconds between requests. This works out of the box with no setup. Capping requests per IP over a longer window requires PRO Login Request Throttling.
How do I change the 30-second resend cooldown?
The 30-second window is the default. Developers can change it with the kc_ml_resend_cooldown filter, which returns the cooldown length in seconds. There is no admin field for the cooldown itself; for admin-configurable limits, use PRO Login Request Throttling.
What is the difference between the cooldown and throttling?
The free cooldown counts per email address and enforces one request every 30 seconds. PRO Login Request Throttling counts per IP address and limits the total requests allowed within a time window (default 10 requests per 15 minutes), so it also stops one source requesting links for many different addresses.
Is Login Request Throttling free or PRO?
Login Request Throttling is a PRO feature, configured at Magic Link → Settings → Security. The 30-second resend cooldown is free and applies on every site regardless of PRO status.
What happens when an IP passes the throttling limit?
Further link requests from that IP are refused until the time window resets. Requests made before the limit was reached still work, and other IP addresses are unaffected, so normal visitors continue to receive their login links.
