Security (PRO)
How Do I Slow Down Repeated Magic Link Requests?
Quick Answer
There are two layers. Every version includes a 30-second resend Cooldown on the login form, and PRO adds Login Request Throttling, which caps how many link requests one IP can make inside a time window.
Resend Cooldown (Free)
After a Magic Link is sent, the form makes the same email wait 30 seconds before it can request another link. This prevents accidental double-sends and rapid repeats out of the box.
You can adjust the wait with the kc_ml_resend_cooldown filter (value in seconds).
Login Request Throttling (PRO)
Go to Settings → Security → Login Request Throttling. Set:
- Max requests — how many link requests are allowed from one IP.
- Time window — the period those requests are counted over.
Once an IP passes the limit inside the window, further requests are refused until the window resets. Unlike the per-email Cooldown, throttling is measured per IP, so it also stops a single source cycling through many addresses.
Why It Matters
Without throttling, a user or bot can keep asking for new login links again and again. That can lead to:
- Too much email traffic
- Extra load on your site
- Unnecessary support requests
Best For
- Busy websites
- Membership portals
- Support-heavy sites
Related
