How to Add Magic Link Login to Your WordPress Site So Login Takes Just One Click

Magic Link login is a passwordless way to sign into a website. Instead of entering a password, a user requests a secure link sent to their email and clicks it to log in. Setting up magic link login in WordPress replaces the traditional password step with this email based flow. It also reduces password reset requests. This guide covers how the feature works, how to configure it, and how it appears on both a standard WordPress login page and a WooCommerce store.

What Is Magic Link Login?

Magic link login is a passwordless way to sign into WordPress website. A user types their email address instead of a username and password. The system then sends a one time link to that email. Clicking the link logs the user in automatically, and the link stops working after a short window of time. Here is the flow in plain terms:

• A user selects the Magic Link option instead of the regular login method
• The user enters their email on the login page.
• A secure, single use link gets generated and sent to that email.
• Clicking the link logs the user straight into the site.
• The link expires after a set time, so it cannot be reused later

For this guide, we will use Ultimate Security to show how the feature works in practice. Magic Link Login is part of the Pro version of the plugin. If you want the full technical reference alongside this walkthrough, the Magic Link Login documentation covers every setting in detail.

How to Configure Magic Link Login With Ultimate Security

Every setting for this feature lives under Login & Authentication → Magic Link. The settings are broken into two sections, and each one controls a different part of how magic link login behaves on your site.

Enabling Magic Link Login and Setting Expiration Time

The first toggle on the page is Enable Magic Link Login. Flip this on and the feature becomes active across your site.

Right below it sits Link Expiration Time. It decides how long a link stays valid after it gets sent. The default is 10 minutes, and you can adjust it from a dropdown. A shorter window is safer, since it gives an attacker less time to intercept or reuse a link. A window that is too short, though, frustrates users who do not check their email right away.

Enabled for Roles controls which user roles get access to passwordless login. You can pick specific roles, or use the Select All and Remove All buttons to move faster. Leave this field empty and every role on your site can use magic link login. It is worth knowing if you only want this available for customers rather than admins.

Controlling Rate Limits and IP Verification

This section is where the feature earns its place as a real security control, not just a convenience option.

Rate Limiting sets a cap on how many magic link requests a single email address can trigger every hour. The default is three requests per hour. Without a limit like this, someone could spam a user’s inbox with login link emails over and over, which is annoying at best and a sign of an attack attempt at worst.

IP Address Verification adds another layer on top of that. When this is turned on, the link only works if it gets opened from the same IP address that requested it in the first place. This closes off situations where a link gets forwarded, intercepted, or opened from a different device than the one that asked for it.

Choosing Where Magic Link Login Appears

The Display Settings section decides where the magic link option shows up on your site, and this includes WooCommerce stores as well.

Show on WordPress Login places the option directly on the standard wp-login.php page, right alongside the regular username and password fields.

Show on WooCommerce Login adds the same option to the WooCommerce My Account login form. This matters most at checkout, where a customer who cannot remember their password often abandons the cart or waits on a slow password reset email instead of completing the purchase. Turning this toggle on lets a customer type their email, get a link, and click through to their account in a matter of seconds, without any interruption to whatever they were trying to buy.

Customizing the Magic Link Email

You are not stuck with a generic looking email. The Email Subject field lets you write a custom subject line, and you can drop in [Site Name] to pull your site title in automatically.

The Email Template field controls the body of the message. Four placeholders are available to build it with:

• {user_name} for the recipient’s name
• {site_name} for your website name
• {magic_link} for the actual login link
• {expiry_minutes} for how long the link stays valid

Leave the template field blank and Ultimate Security uses its default layout, which already includes all four placeholders correctly.

Adding the Magic Link Form with a Shortcode

Sometimes you want a login form somewhere other than the default login page, like a membership page or a custom account screen. The shortcode below drops a magic link form anywhere on your site:

[ultimate_security_magic_login]

A few optional attributes give you more control over how it behaves:

[ultimate_security_magic_login redirect="/dashboard" button_text="Get Magic Link" class="my-button-class"]

The redirect attribute decides where a user lands after logging in, button_text changes the wording on the button, and class lets you attach your own CSS styling. This is a handy option if your login page does not run through the standard WordPress form at all.

How to Log In with Magic Link on the WordPress Login Page

From a user’s perspective, none of the settings above really matter. What matters is how simple the login screen feels, and this is where magic link login WordPress setups genuinely shine.

On the standard WordPress login page, users will see the usual username and password fields, just like always. Below the password field, though, sits a new option: Login with Magic Link. Password login has not gone anywhere, so anyone who still prefers typing a password can do exactly that.

Clicking “Login with Magic Link” prompts the user for their email address. Once they submit it, Ultimate Security sends the link, and a quick check of their inbox gets them logged in with one click.

Monitoring Magic Link Activity in the Logs

Once the magic link login is live, you will want a way to check that it is actually working the way you expect. The Logs page, found under Login & Authentication → Magic Link → Logs gives you exactly that.

At the top, six counters show a running total of activity: Created, Used, Success, Rate Limited, Expired, and Failed. Below that sits a searchable table listing every event by ID, event type, email, user, IP address, result, message, and date. You can filter by time range, search for a specific email or IP, export everything to CSV, or delete entries you no longer need.

This page is worth a quick check every so often, even when nothing seems wrong. A sudden jump in Rate Limited or Failed events tied to one email address is usually a sign that someone is probing that account, and catching it here beats finding out later.

Frequently Asked Questions

Conclusion

Magic link login replaces the password step with a one time link sent to a user’s email. In Ultimate Security, the feature includes controls for link expiration, rate limiting, IP verification, and where the option appears, along with a Logs page that records every request and login attempt. It works on the standard WordPress login page and can also be enabled for WooCommerce, giving customers a password free way to sign in at checkout.