Security (PRO)
Trusted Email Domains That Auto-Create Magic Link Users
Need people from a partner company or school to log in without creating accounts by hand first? Trusted Domains lets anyone whose email is on a domain you trust request a Magic Link even if they have no WordPress account yet. On the first request, Magic Link auto-creates a user with the role you choose and logs them in.
PRO feature
Trusted Domains is part of the Security tab, which is available in Magic Link PRO. The entire Security tab and its settings require a PRO license.
What is Trusted Domains?
Trusted Domains is a Magic Link PRO onboarding feature. When a magic-link request arrives for an email address on a trusted domain that has no matching WordPress user, the plugin creates that user automatically with a role you set, then sends the login link. It removes the manual step of creating accounts for people you already know you want to admit.
How to set up Trusted Domains
- In WordPress admin, go to Magic Link → Settings → Security.
- Find the Trusted Domains section and turn its Enable switch on. It is off by default.
- In the Trusted Domains textarea, add each domain you trust — one domain per line, for example
partner.comorschool.edu. - Set New User Role to the role auto-created users should receive. The default is Subscriber.
- Save your changes.
How it works
- A visitor requests a Magic Link using an email on a trusted domain.
- If no WordPress account exists for that email, Magic Link creates one with your chosen New User Role.
- The magic link logs them in as usual.
Because a real WordPress account is created, the person keeps normal access on every later visit — the account is not temporary.
Settings reference
| Setting | What it does | Default |
|---|---|---|
| Enable | Turns Trusted Domains on or off. | Off |
| Trusted Domains | One domain per line. Emails on these domains can request a link with no existing account. | Empty |
| New User Role | The WordPress role given to auto-created users. | Subscriber |
Trusted Domains vs Domain Restriction
These two Security settings are easy to confuse but do opposite jobs:
- Domain Restriction limits who can request a link — it refuses domains that are not approved. See restrict Magic Link login to approved email domains.
- Trusted Domains admits new people — it lets a trusted domain get a link and creates an account when one does not exist.
You can use both together: restrict requests to approved domains, and let a subset of trusted domains auto-create accounts.
Example
If partner.com is a trusted domain set to the Subscriber role, then name@partner.com can request a Magic Link even with no existing account. On first login, a Subscriber account is created for them automatically.
Conclusion
Trusted Domains is the fastest way to onboard people you already know — partners, staff, or students — without building accounts one at a time. If you want to limit who can request a link rather than admit new users, pair it with Domain Restriction.
FAQs
Is Trusted Domains free?
No. Trusted Domains is on the Security tab, which is a Magic Link PRO feature. The whole Security tab — Trusted Domains, Domain Restriction, and Access Control — requires a PRO license. The free version cannot auto-create accounts from an email domain.
What role do auto-created users get?
They receive the role you pick in New User Role, which defaults to Subscriber. Choose any registered WordPress role — for example Customer or Contributor — to match how you want these people to access your site. The role applies to every account created through a trusted domain.
Is the auto-created account temporary?
No. Trusted Domains creates a normal, permanent WordPress user account. After the first login, the person keeps access on future visits like any other registered user, and the account appears in the WordPress Users list where you can edit or remove it.
How is Trusted Domains different from Domain Restriction?
Domain Restriction refuses login requests from domains you have not approved. Trusted Domains does the opposite: it lets people on a trusted domain get a link and creates an account for them if none exists. One limits access; the other streamlines onboarding. They are separate settings that can be enabled together.
What if someone on a trusted domain already has an account?
Nothing changes for them. Trusted Domains only creates a new user when no account matches the email address. Existing users simply receive their Magic Link and log in to the account they already have, keeping their current role and data.