Magic Login lets an existing WordPress user request an email link to sign in without entering a password. It is useful for a dedicated email login page or for regaining access after losing a passkey.
Magic Login is off by default. Enable it in Guard Dog → Authentication → Magic Login.
How It Works
- On the WordPress login screen, select the Email me a sign-in link button with the envelope icon to open the email sign-in form. This also works at your custom login URL. Alternatively, visit a public page where the site owner has added the Magic Login form.
- Enter your username or email address, then select Email me a sign-in link on the request form.
- Guard Dog sends a short-lived login link to the email address on your existing WordPress account.
- Open the email link, check the account shown, and select Continue to confirm sign-in. Opening the link alone does not use it, which helps prevent email scanners from consuming it.
- Complete any required two-factor authentication.
- Guard Dog sends you to the configured page on your site.
The request form does not ask for or display a password. It uses the same confirmation message whether an eligible account exists or not. Magic Login does not create accounts or change your registration form.
Settings
| Setting | Default | Purpose |
|---|---|---|
| Enable Magic Login | Off | Allow existing users to request email sign-in links. |
| WordPress Login Screen | On | Show the Email me a sign-in link button on the native WordPress login screen when Magic Login is enabled, including a custom login URL. |
| After Login | Site home page | Choose the page users reach after successful sign-in. |
| Link Expiration | 10 minutes | Set a lifetime between 5 and 30 minutes. Every link is single-use. |
Use a URL on your own site for After Login. Relative paths such as /account/passkeys/ are supported. An empty or invalid destination falls back to the site home page; external destinations are not accepted.
Email delivery uses your configured Guard Dog email provider. If no provider is configured, it uses WordPress email delivery (wp_mail), including any existing SMTP integration. Test delivery using an account and mailbox you control before adding a public recovery link.
Add the Form to a Page
Add the Guard Dog Magic Login block to a public page. Its After login URL control can override the site setting for that form.
Or use a shortcode:
[guard_dog_magic_login]
For a page with its own destination:
[guard_dog_magic_login redirect_to="/account/passkeys/"]
The optional redirect_to attribute accepts a same-site URL or relative path. Omit it to use the Magic Login setting. The block editor shows an explanation of the form; it does not send email from the editor.
Magic Login must be enabled globally for the request form to appear to logged-out visitors. The native login screen option does not automatically add the form to frontend pages; use the block or shortcode where you want it.
Recover a Lost Passkey
To offer email recovery with Guard Dog's passkeys:
-
Enable Guard Dog → Authentication → Passkeys and Magic Login.
-
Create an account page, for example
/account/passkeys/, containing the Guard Dog Passkeys block or[guard_dog_passkeys]shortcode. -
Create a public recovery page with the shortcode below:
[guard_dog_magic_login redirect_to="/account/passkeys/"] -
Link to that recovery page from your login or help page.
-
Test the complete flow as a regular member: request an email, confirm sign-in, complete any required 2FA, register a replacement passkey, then sign out and sign in with the new passkey.
Passkey management requires a signed-in user. Magic Login does not delete old passkeys; users can remove a lost passkey from their account once they have secured access.
The recovery form contains no password field. If you also want password-free registration, configure and test that separately in your registration or membership plugin. Magic Login signs in existing WordPress accounts; third-party membership sessions and third-party passkey enrollment pages require a separate compatibility test on your site.
Simple Membership and WP-WebAuthn
Local compatibility testing with Simple Membership 4.8.2 and WP-WebAuthn 1.3.4 and 1.4.1 verified email recovery, third-party passkey enrollment, and native WordPress passkey login for an existing active member. Required Guard Dog app 2FA also completed during Magic Login. These tests used a browser with a virtual authenticator; test your own forms, devices, and membership settings before relying on the combination.
Simple Membership's stock registration still requires a password, and its profile form displays password fields. Those forms need separate customization for an experience where members never see a password. Membership restrictions also remain separate from WordPress authentication: a WordPress session does not guarantee access to membership-protected content.
WP-WebAuthn 1.4.1's front-end login shortcode failed in this test; its native WordPress login integration worked. WP-WebAuthn's own passkey login also runs outside Guard Dog's 2FA checks. Enabling Guard Dog 2FA therefore does not make that separate login method require a Guard Dog code. Magic Login's required-2FA checks still apply to email sign-in.
Security and Account Rules
Enabling Magic Login makes access to the account's mailbox a way to sign in. Protect that mailbox and keep the user's email address current.
Magic Login respects Guard Dog's account restrictions and two-factor authentication. It does not clear account blocks, verify an unverified account, or act as a replacement for a required second factor. A user who also loses their second factor needs the applicable 2FA recovery process.
If the site's password expiration policy requires an account to update its password, Magic Login also refuses sign-in until that requirement is resolved. For a fully password-free membership experience, review that policy alongside your registration and recovery settings.
Request limits help prevent repeated email sends. Do not share login links or place them in support tickets. Exclude login, recovery, and confirmation pages from full-page caching so visitors receive fresh forms and private responses.
Troubleshooting
No login email arrives
Check the account's email address, spam folder, and email provider or SMTP configuration. Request limits may temporarily suppress repeated requests. The public response intentionally does not reveal whether an account exists or is eligible to log in.
A link has expired or was already used
Return to the form and request a new link. Complete sign-in before the configured expiration time.
The user returns to the home page
Check the global After Login setting and any redirect_to override on the page. The destination must belong to this site.
A member cannot access a third-party enrollment page
Confirm the page accepts a signed-in WordPress user and that the membership plugin's account status allows access. WordPress sign-in does not by itself establish compatibility with a separate membership authentication system.
← Passkeys | Documentation Home | Frontend Account Security →