Magic Link Troubleshooting and FAQ

Magic link not working? Most problems come down to three causes: the email never arrived, the link expired or was already used, or a setting is redirecting or blocking the user. Start by checking the Magic Link → Health page to confirm your site can send email, then work through the section below that matches your symptom. Each fix uses the exact admin path so you can resolve it quickly.

Magic Link is an email-only passwordless login plugin, so almost every issue is either an email-delivery problem or a link-validity setting.

The user did not receive the email

If the login email never arrives, work through these checks in order:

1. Ask the user to check their spam or junk folder.
2. Confirm the email address on the WordPress account is correct.
3. Verify your site can send email reliably — many WordPress sites need an SMTP plugin for consistent delivery.
4. Open the Health Check page to confirm wp_mail is working.
5. Review the audit log for a sent, failed, or bounced event for that user.

The link says "invalid" or "expired"

A magic link stops working once it expires or reaches its usage limit:

• The link may have expired based on your Token Lifespan setting.
• The link may have already been used if Token Validity limits it to one use.
• Generate a new link and try again. You can check both settings under Magic Link → Settings → General.

The user sees a "Confirm it's you" page first (intended)

When a user clicks a magic link, they may first see a short Intent Confirmation page asking them to confirm it is really them. This is intentional and should be left on.

It is the free scanner protection feature. Email and link scanners (such as Outlook Safe Links, Mimecast, and Proofpoint) often open links automatically, and without this step they would silently consume a one-time magic link before the real user clicks it. The user simply clicks the confirmation button to complete sign-in.

How to revoke a user's magic links

Admins can invalidate a user's active links at any time. Go to Users → All Users and use the per-user Revoke Magic Links row action (also available as a bulk action). This is useful if a link may have been exposed or a user reports suspicious activity.

The user is redirected to the wrong page

If sign-in works but sends the user to an unexpected page:

• Check the Login Redirect setting under Magic Link → Settings → General.
• If PRO role-based redirects are enabled, role-specific URLs override the single Login Redirect URL. See redirect after login.

The domain is not allowed (PRO)

• Review the Domain Restriction allow and block lists under Magic Link → Settings → Security.
• Remove typos and enter one domain per line (for example, example.com).

Too many requests, or the user is blocked (PRO)

• This usually means Login Request Throttling or Brute Force Protection is active.
• Wait for the cooldown or block period to pass, or adjust the limits under Magic Link → Settings → Security.
• Note that the free resend cooldown on the shortcode can also briefly block repeated requests.

Best-practice checklist

1. Keep token lifespan short.
2. Use single-use links for higher security.
3. Test the login flow after changing settings.
4. Keep at least one administrator account recovery path.
5. Review the audit log and Health Check if something looks off.

Conclusion

Most Magic Link issues resolve quickly once you know whether the cause is email delivery, link validity, or a redirect or security setting. Use the Health page to confirm email sending and the audit log to see what happened during a failed login. If you are a PRO user and still stuck, Priority Support can help.

FAQs

Why is my magic link email not arriving?

The most common cause is WordPress email delivery. Check the recipient's spam folder, confirm the account email is correct, and make sure your site sends email reliably (many sites need an SMTP plugin). Open the Magic Link → Health page to confirm wp_mail works, and check the audit log for a sent, failed, or bounced event.

Why does my magic link say it is invalid or expired?

A magic link stops working when it passes its Token Lifespan or reaches its Token Validity usage limit. If the link expired or was already used, generate a fresh one. You can adjust the lifespan and how many times a link can be used under Magic Link → Settings → General.

Why do users see a confirmation page before logging in?

That is the free Intent Confirmation and scanner-protection feature. Email security scanners open links automatically, which would otherwise consume a one-time link before the real user clicks it. The confirmation page requires an explicit click, so scanners cannot burn the link. It is intentional and should stay enabled.

How do I revoke a user's magic links?

Go to Users → All Users and use the Revoke Magic Links row action, or select users and use the bulk action. This invalidates that user's active links immediately, which is useful if a link may have been exposed or a user reports suspicious activity.

Why is a user being blocked with "too many requests"?

If you use Magic Link PRO, this usually means Login Request Throttling or Brute Force Protection is active in the Security tab. Wait for the cooldown or block period to end, or adjust the limits under Magic Link → Settings → Security. The free resend cooldown on the shortcode can also briefly block rapid repeated requests.