Temporary logins for WordPress

What it does

The usual way to give a contractor access is to create an account, share a password over chat, and forget to delete it: three security mistakes in one workflow. Temporary logins replace all of it: create a time-boxed account, send a login link, and let expiry handle the cleanup.

How it works

Creating a temporary user takes a role, a name and an expiry. The account gets a strong random password nobody ever sees and a login token stored only as a SHA-256 hash. The express login link logs its holder straight in, exactly once. Used links are dead links, and a second click gets "This login link has already been used."

A sweeper deletes expired temporary accounts automatically, the users list shows login links and last-login info for temporary accounts, and the list exports to CSV. Only administrators can create or delete temporary users.

• One-click express login links, single-use by design
• Expiry presets or a custom date; accounts delete themselves
• Role, redirect target and locale per account
• Login-link column and CSV export in the users list
• Administrator-only creation and deletion