How to add passwordless member login to WordPress

Decide whether members will enter an email address, a username, or either one. The usual flow is: the member submits their identifier, WordPress sends a time-limited link, and clicking that link creates the normal logged-in session before redirecting the member to their account or course.

Keep ordinary password login available while you introduce passwordless login. It gives members a fallback if they cannot access their email and gives administrators a recovery route.

WordPress core provides the standard login page at wp-login.php, but it does not provide a complete passwordless member-login flow. A manual implementation therefore needs a custom plugin, not just a setting or a small theme tweak.

The plugin must create unpredictable, single-use tokens, store them safely, expire them, rate-limit requests, avoid revealing whether an email belongs to an account, authenticate the correct user, enforce your membership rules, and invalidate the token immediately after use. It also needs safe redirects and a dependable email path. Do not build this by placing a reusable user ID or secret in a URL.

This route is reasonable for a developer who needs unusual behaviour or already maintains a custom authentication plugin. For most membership sites, the security and support burden is not worth writing from scratch.

Configure transactional email before turning the feature on for members. Magic-link plugins normally send through WordPress mail functions, so poor hosting mail configuration can leave users waiting for links that never arrive. An SMTP service or a properly configured transactional mail provider is the safer setup.

Send a link to a real test account and check the inbox, spam folder, link destination, expiry message, and redirect. Also check that your caching, security, cookie-consent, and URL-rewriting tools do not alter the login-link request.

For the fast route, install Paid Memberships Pro and its Magic/Passwordless Login add-on. In the WordPress dashboard, open Memberships > Add Ons, find the add-on, install it, and activate it. Paid Memberships Pro must already be active.

The add-on adds an “Email Me a Login Link” option to the WordPress login page and PMPro frontend login forms. A member enters an email address or username, receives a secure link, and is logged in when the link is opened.

On Paid Memberships Pro 3.4 or later, edit the message under Memberships > Settings > Email Templates and select Login Link. Keep the !!login_link!! variable in the email body or the authentication link will not work. You can also include a short warning that the link should not be forwarded.

The add-on uses a single-use link that expires after 15 minutes and limits a member to one request every five minutes. It deliberately shows a generic confirmation message when the submitted address is not linked to an account, which helps prevent account discovery.

Test with an active member, an expired member, an unknown email address, an expired link, a link opened twice, repeated requests, and a member who has no access to their inbox. Confirm that restricted pages still check membership after login and that the member lands on the right account or course page.

Do not remove the normal password login until you have tested account recovery and administrator access. If you use two-factor authentication, CAPTCHA, a custom login form, or aggressive security rules, test those integrations separately. The PMPro add-on fires the normal WordPress login action after token authentication, but third-party compatibility still needs checking on your site.