How to Grant Temporary WordPress Access Without Sharing Passwords

The Problem with Password Sharing

Every WordPress site owner has been there: a developer asks for admin access, you hand over your password, and then forget to change it. Weeks later, that developer no longer works with you — but the password is still valid.

This is a security hole that most people ignore because the alternatives feel too complicated. Magic Login changes that.

The Magic Login Approach

Instead of sharing your password, you generate a one-time login link tied to a specific user account. The link works once, expires after a set time, and can optionally be locked to the recipient's IP address.

Step-by-step: Granting temporary access

1. Go to Users → All Users in your WordPress admin
2. Click on the user you want to generate a link for (or create a temporary account)
3. Scroll to the Magic Login section in the profile editor
4. Set an expiration duration and optionally enable IP binding
5. Click Generate Link and copy it
6. Send the link to your developer or client via Slack, email, or any secure channel

IP Binding: Extra Security

When IP binding is enabled, the login link will only work from the IP address it was generated for. Even if the link is intercepted or forwarded, it cannot be used from a different network. This is especially useful for remote developers or contractors.

A magic login link has a zero-knowledge footprint — the recipient never learns your password or any other credentials.

Best Practices

• Create a dedicated Editor or Contributor role account for contractors — don't generate links for your admin account.
• Set expiration to the shortest window necessary for the task.
• Always enable IP binding for external developers.
• Delete or disable the temporary user account when the work is done.