Monitoring & Logs
How to Track Magic Link Logins with the WordPress Audit Log
Need to know exactly who logged in, when, and whether their sign-in link worked? The free Audit Log in Magic Link records the key events in a link's life and lets you browse, filter, and export the history. Open it under Magic Link → Audit Log to see a timeline of sent, used, failed, and revoked links (plus generated and opened events for the flows listed below).
What is the Magic Link Audit Log?
The Audit Log is a built-in, browsable record of every passwordless login event on your WordPress site. Each time a magic link is created, emailed, opened, or consumed, Magic Link writes a row you can review later. It is included in the free version and needs no configuration to start recording.
Open the Audit Log
- In the WordPress admin, go to Magic Link → Audit Log.
- The most recent events load first, newest at the top.
- Use the filters and search to narrow the view (see below).
What the Audit Log records
These event types are recorded in the current release (2.3.0):
| Event | What it means | Good to know |
|---|---|---|
| Sent | The sign-in email was handed to WordPress for sending. | Recorded for every email, including the ones requested on the standard login screen. The entry shows the time, IP address, and browser of the request, but not the recipient. |
| Used | The link was successfully used to sign in. | This is your "who logged in, and when" record. It includes the user, email address, IP address, and browser. |
| Failed | A sign-in attempt did not work: an unknown user, or an invalid, expired, or already-used link. | The reason is stored with the entry. |
| Revoked | An admin revoked a user's links. | Triggered by Revoke Magic Links on the Users screen. |
| Generated | A link was created by one of the "background" flows: the [magic_link_form] shortcode or block, PRO bulk claim emails, the PRO REST API, or the MemberPress and Paid Memberships Pro integrations. |
Links requested on the standard wp-login.php screen and links made with WP-CLI do not add a Generated entry. |
| Opened | A link created from the WordPress admin was opened, before the user confirmed the sign-in. | Only recorded for admin-created links. |
Expired, Delivered, and Bounced
The event filter and the PRO webhook settings also list Expired, Delivered, and Bounced, but the plugin does not record these events yet, so you will not find any of them in the log. WordPress itself does not report whether an email was delivered or bounced. To investigate delivery problems, check your SMTP or email-service provider's own logs. Links that have passed their lifespan appear with an Expired status on Magic Link → Magic Links.
Filter, search, and export
The Audit Log is built for quick review, even on busy sites:
- Event-type filter — narrow the list to a single event, such as only Used or only Failed.
- Free-text search — find entries by email address or user.
- Pagination — move through large histories without loading everything at once.
- CSV export — download the current view to open in a spreadsheet or attach to a support ticket.
How to read the log
The event mix tells you whether logins are healthy:
- A run of Failed events usually means people are using old, already-used, or mistyped links, or that someone is probing your login. For missing emails, the log cannot help: check your mail provider's logs and see Troubleshooting.
- A steady flow of Sent and Used events means users are reaching their accounts without friction. Many Sent with few Used entries means people ask for links but do not complete the sign-in: check that emails arrive, and that the 5-minute default lifespan is long enough for your audience.
- If users often report "expired" links, your token lifespan may be too short — adjust it on the expiry settings page.
If events look wrong or emails are not arriving, see Troubleshooting.
Anomaly detection (PRO, not active yet)
Not switched on in version 2.3.0
Magic Link PRO includes the code for anomaly detection (it can spot bursts of failed sign-ins from one IP, and an administrator signing in from a country never seen before), but in version 2.3.0 nothing runs it, so no alerts or flags appear in the Audit Log. For protection against repeated failures today, use PRO Brute Force Protection.
Clear or export the audit log
The Audit Log page also includes Clear All Logs, which permanently removes the stored audit entries after confirmation. Use this only when you intentionally want to reset the log.
Magic Link PRO adds Export CSV, so you can download the filtered audit data for reporting or external analysis.
Conclusion
The free Audit Log gives you a complete, filterable, exportable record of every Magic Link event, so you can confirm sign-ins are working and catch delivery or security problems early. Pair it with a scheduled summary from the Email Digest, and confirm your setup on the Health page.
FAQs
Is the Magic Link Audit Log free?
Yes. The Audit Log ships with the free version of Magic Link and records every login event with no configuration. You can browse it, filter by event type, search by email or user, and export the current view to CSV. Automatic anomaly detection over the log is a PRO addition, but the log itself is free.
Where do I find the login history in WordPress?
Go to Magic Link → Audit Log in your WordPress admin. The page lists every magic-link event newest-first, with a filter for event type and a free-text search for email addresses or users. This is the single place to see when links were generated, sent, delivered, opened, and used.
What login events does Magic Link track?
The Audit Log records six event types in the current release: sent, used, failed, revoked, plus generated and opened for the flows described above. The filter and webhook screens also list expired, delivered, and bounced, but those are not recorded yet.
Can I export the Magic Link audit log?
Yes. The Audit Log includes a CSV export of the current view, so you can open the history in a spreadsheet, archive it, or attach it to a support request. Apply an event-type filter or search first to export just the rows you need.
How do I tell if magic link emails are failing?
The Audit Log cannot see email delivery or bounces, because WordPress does not report them. A Sent entry only means the email was handed to your mail system. If users say they never got a link, check your SMTP or email-service provider's logs and spam folders first, then follow the Troubleshooting guide. Failed entries help with a different problem: links that were invalid, expired, or already used.