Magic Login – Passwordless Authentication for WordPress – Login Without Password

Changelog

2.8 (May 07, 2026)

• [Added] Native honeypot protection for Magic Login forms.
• [Updated] Dependencies.

2.7.1 (Mar 15, 2026)

• [Fixed] Settings import failing on some sites due to restricted MIME type filters when uploading JSON files.

2.7 (Mar 14, 2026)

• [Added] Friendly captcha. (UI)
• [Improved] Load fonts locally to enhance privacy.
• [Improved] Added nonce validation to AJAX-based login requests.
• [Improved] Added final login redirect validation for both standard and AJAX login flows.
• [Improved] Strengthened the randomness used for generated email login codes.
• [Added] Added a per-user safeguard to limit repeated login emails for the same account.
• [Updated] Dependencies.
• Tested with WP 7.0

2.6.3 (Feb 18, 2026)

• [Updated] Dependencies.

2.6.2 (Nov 14, 2025)

• [Added] Admin notice when placeholder encryption keys/salts are in use.
• [Fixed] Added capability checks for the settings page.
• [Fixed] Improved validation of $_SERVER variables.
• [Improved] Settings import file validation.

2.6.1 (Nov 05, 2025)

• [Updated] Dependencies.
• Tested with WP 6.9

2.6 (Jul 22, 2025)

• [Added] Ability to override TTL and token validity on a per-user basis.
• [Updated] Dependency packages to latest versions.
• Read the full update: Magic Login PRO 2.6

2.5.1 (Jun 02, 2025)

• [Added] No-cache headers for magic login links to prevent caching issues.

2.5 (May 10, 2025)

• [New] Tools Section – Added reset, export, and import options in the settings panel. Learn more
• [Updated] Settings UI – Visual and structural improvements to reflect new PRO features.
• [Updated] Dependencies.
• [Changed] Minimum PHP version raised to 7.4.
• Read the full update: Magic Login 2.5

2.4.2 (April 14, 2025)

• [Added] New filter magic_login_email_placeholders to customize email placeholders.
• [Updated] Dependencies.
• Tested with WP 6.8

2.4.1 (March 10, 2025)

• Small tweaks and improvements.

2.4 (March 05, 2025)

• [New Feature] Code Login – Users can log in with a code sent to their email or phone number instead of clicking a link.
• [Improvement] UI update for SMS Login feature. Learn More
• [Improvement] Applied login_redirect filter before magic_login_redirect to allow other plugins to modify the redirect URL.
• [Improvement] login.php is now deprecated in favor of LoginManager class.
• [Fix] Properly encode the redirection URL on the wp-login page.
• [Fix] Corrected various typos. Props @szepeviktor
• Read the full update: Magic Login 2.4

2.3.5 (January 03, 2025)

• [Fixed] Ensure proper handling of email recipient for {{MAGIC_LINK}} integration.
• [Fixed] French translation.
• [Improved] Applied array_shift() to extract the first recipient if $atts['to'] is an array.

2.3.4 (December 18, 2024)

• [Improved] {{MAGIC_LINK}} placeholder to support encoded values.
• [Improved] JavaScript handling for the magic login button by using esc_url_raw for form action and redirect URLs.
• [Added] magic_login_get_wp_login_url filter for customizing the login URL.
• [Deprecated] \MagicLogin\Utils\get_magic_login_url, use \MagicLogin\Utils\get_wp_login_url instead.
• [Updated] Dependencies.

2.3.3 (November 19, 2024)

• [Improved] Enhanced login request handling with prioritized processing and added logging for header_sent scenarios.
• [Improved] Implemented pre-validation checks before magic link replacement to prevent potential issues.
• [Updated] Dependencies.
• Tested with WP 6.7

2.3.2 (October 07, 2024)

• [Improved] Two-factor compatibility.
• [Updated] Dependencies.

2.3.1 (September 09, 2024)

• Minor tweaks and adjustments.
• [Updated] Dependencies.

2.3 (July 10, 2024)

• [Added] REST API option to UI.
• [Added] Passing magic_login_form to shortcode_attr for better customization.
• [Updated] Dependency updates.
• Tested with WP 6.6
• Learn more about the new features: Magic Login 2.3

2.2 (May 29, 2024)

• [Added] Settings UI update with reflecting new PRO features.
• [Added] Custom events for AJAX requests.
• [Added] New filter magic_login_token_ttl_by_user to customize TTL for users.
• [Added] New filter magic_login_error_message to customize error messages.
• [Improved] Form styles.
• [Refactored] Improved settings page UI.
• [Refactored] Enhanced class autoloading.
• [Updated] Dependency updates.
• Learn more about the new features: Magic Login Pro 2.2

2.1.3 (April 19, 2024)

• Improvements on uninstallation process.

2.1.2 (April 08, 2024)

• Fix auto-login link when the recipient is specified in an array format.
• Dependency updates.

2.1.1 (March 13, 2024)

• Tested with WP 6.5
• Dependency updates.

2.1 (February 13, 2024)

• Updated settings page with PRO features.
• Added new attributes for shortcode; it’s more flexible than ever. Learn More
• Fix: Encode the redirect_to parameter in the login link. (Better nG firewall compatibility)
• Dependency updates.

2.0.1 (January 15, 2024)

• Fix German language that breaks auto-login links.
• Dependency updates.

2.0 (November 07, 2023)

• Add {{MAGIC_LINK}} support to all outgoing emails that received by a single user.
• Add new placeholder supports: {{FIRST_NAME}}, {{LAST_NAME}}, {{FULL_NAME}}, {{DISPLAY_NAME}}, {{USER_EMAIL}}
• Add ajax spinner to the login form.
• Dependency updates.
• Minor tweaks on settings form.

1.9.1 (October 26, 2023)

• Added French translation.
• Dependency updates.
• Fix deprecated variable format.
• Tested with WP 6.4

1.9 (July 25, 2023)

• Added: AJAX support for login requests.
• Bumped PHP requirement to 7.2+
• Small tweaks and improvements.
• Tested with WP 6.3

1.8.1 (May 15, 2023)

• Added: Styling for two-factor plugin.
• Minor UI changes.
• Small tweaks and improvements.
• Tested with WP 6.2

1.8 (February 18, 2023)

• New feature: Token Validity – allows to specify how many times a token can be used.
• Improvements on the default login screen
• i18n improvements
• Added: German translation.
• Added: Autocomplete support.
• Added: New token {{TOKEN_VALIDITY_COUNT}} to customize email content.

1.7 (January 21, 2023)

• PHP 8.1: fix deprecated ‘FILTER_SANITIZE_STRING’
• UI/UX improvements on default login screen
• i18n improvements. Props @emreerkan
• Fix: standard wordpress redirect functionality. Props @maartenhunink
• Fix: Skip the auto-login link for the magic login itself.
• Fix: Send email only once.

1.6 (October 26, 2022)

• New feature: Auto Login Links

1.5.2 (September 27, 2022)

• Bug fix: token validation

1.5.1 (September 26, 2022)

• Fixed: redirection issue.
• Minor UI updates.
• Small tweaks and improvements.
• Tested with WP 6.1

1.5 (September 12, 2022)

• Fixed: save tokens hashed in DB. Props @snicco
• Added: username-only mode. define MAGIC_LOGIN_USERNAME_ONLY in the config file to use it.
• Email improvements: Check email contents before converting line breaks to <br/> tags.
• Small tweaks and improvements.

1.3 (April 19, 2022)

• Tested with WP 6.0
• UI updates.
• Fire wp_login hook as WP Core does on successful login.
• Add new filter: magic_login_email_headers.
• Fix email title html escaping.
• Small tweaks and improvements.

1.2.2

• Tested with WP 5.9
• Update Shared UI
• Fix compatibility issue with TML plugin
• Add redirection cancellation option to the login block.
• Check logged-in while saving the settings
• Small tweaks and improvements.

1.2.1

• New: Integrate with the standard login form.
• Fix: Enqueue admin assets on the settings page only.
• Allow login block only once for a post.
• Small tweaks and improvements.

1.2

• New: Magic Login Block – It’s much easier to add and customize the login form in the block editor.
• Customizable token intervals added. (removed 1-60 minutes restriction)
• New placeholder added: {{EXPIRES_WITH_INTERVAL}} to display TTL with the interval.
• Updated Shared UI
• Improved documentation on settings page.
• New: Show an error message when the user doesn’t exist.
• New filter: Added magic_login_invalid_token_error_message to customize error message.

1.1.3

• Fix: Scheduled expired token cleanup

1.1.2

• Update Shared UI
• Shortcode magic_login_form now supports redirect_to attribute
• fix: don’t display login form if the user already logged-in

1.1.1

• Hotfix: return shortcode output instead of printing

1.1

• Tested with WP 5.8
• Shortcode magic_login_form support added!
• fix: make sure deactivate_plugins exists when manually switching versions

1.0.3

• Update Shared UI
• fix: add text-domain for missing strings

1.0.2

• Update Shared UI
• Tested with WP 5.7

1.0.1

• Update Shared UI

1.0

• First release