Skip to content

Sign-in

Magic links for locked-out users

Pro and AgencyAbout Login Protection

Lets a real user who has been locked out ask for a one-time sign-in link by email, instead of waiting for the lockout to end or calling you.

What it does

When brute force protection locks out an address, the sign-in page offers to email a magic link. The user types their username or email address, and if their address really is locked out, a link arrives in their inbox.

Clicking the link lifts the lockout on their address and signs them in. If they use two-factor sign-in, they still have to pass the second step.

Why it matters

Strict lockouts stop robots, but they also catch people who mistype a password a few times. Magic links let you keep lockouts strict without locking your own team out.

Set it up

  1. Make sure Brute Force Protection is on: magic links only appear for locked-out addresses.
  2. On the Login tab, section Sign-in security, switch on Magic Links.
  3. Set Link Expiration: how many minutes a link works. 15 is the default.
  4. Click Save Changes, and check that your site can send email (the Notifications tab has a test button).

Good to know

The page gives the same answer whether or not the account exists, so it cannot be used to find usernames.

One link per user every 2 minutes, and each link works once. Asking for a new link cancels the old one.

The link lifts the lockout on the address. A lockout on the username itself (the Pro per-user limit) stays until it runs out.

Which plan includes it

Magic links are part of Pro.

How it works, for developers
  • Links carry a 64-character random token in ?smg_magic=; only a hash of it is stored, in the smg_magic_links table. Links are handled on init at priority 5.
  • Requests go to the smg_request_magic_link AJAX action, which is open to visitors who are not signed in and is rate limited per user (one per 2 minutes) and per address.
  • A link is only sent when the requesting address is locked out right now. Using it clears locked_until for that address in smg_login_attempts.
  • Expired links are removed daily by the smg_cleanup_magic_links scheduled task.
  • Settings: smg_magic_links_enabled, smg_magic_link_duration (minutes).

Quick answers about magic links for locked-out users

What does Magic links for locked-out users do in Stack Guard?

When brute force protection locks out an address, the sign-in page offers to email a magic link. The user types their username or email address, and if their address really is locked out, a link arrives in their inbox. Clicking the link lifts the lockout on their address and signs them in. If they use two-factor sign-in, they still have to pass the second step.

Why use magic links for locked-out users on a WordPress site?

Strict lockouts stop robots, but they also catch people who mistype a password a few times. Magic links let you keep lockouts strict without locking your own team out.

How do I set up magic links for locked-out users?

1. Make sure Brute Force Protection is on: magic links only appear for locked-out addresses. 2. On the Login tab, section Sign-in security, switch on Magic Links. 3. Set Link Expiration: how many minutes a link works. 15 is the default. 4. Click Save Changes, and check that your site can send email (the Notifications tab has a test button).

Which Stack Guard plan includes magic links for locked-out users?

Magic links are part of Pro.

More in Sign-in

Not running Stack Guard yet? It is free.

Download Free