Temporary Login

The Temporary Login function allows administrators to generate secure, one-click login URLs for temporary access to your WordPress site.

Overview

Sometimes you need to grant temporary access to your site for support technicians, developers, or collaborators without sharing permanent credentials. The Temporary Login function creates secure, time-limited login URLs that automatically expire, providing a safe way to share access.

Key Features

• Generate secure one-click login URLs
• Set custom expiry times (hours or days)
• Create logins for existing users or temporary user accounts
• Custom redirect URL after login
• Enable/disable tokens without deleting
• Full audit logging of all login attempts
• Automatic cleanup of expired tokens
• Add notes to track purpose of each login

Setup Instructions

Step 1: Enable the Function

1. Navigate to Voxel Toolkit → Functions in your WordPress admin
2. Find Temporary Login in the list
3. Toggle the switch to enable the function

Once enabled, a new Temp Logins (VT) menu item will appear under the Users menu in your WordPress admin sidebar.

Creating a Temporary Login

For Existing Users

1. Go to Users → Temp Logins (VT)
2. In the “Create New Temporary Login” section, select Existing User
3. Choose the user from the dropdown
4. Set the expiry time (e.g., 7 days)
5. Optionally set a redirect URL (defaults to admin dashboard)
6. Add optional notes (e.g., “For developer John – debugging issue #123”)
7. Click Create Temporary Login

For New Temporary Users

If you don’t want to grant access to an existing account, you can create a temporary user account:

1. Select Create New Temporary User from the User Type dropdown
2. Enter a username (e.g., “temp_support_jan”)
3. Enter an email address
4. Select the role for the temporary user (e.g., Editor, Administrator)
5. Set expiry and other options as needed
6. Click Create Temporary Login

Temporary users are marked with a “Temp User” badge in the login table and can be automatically deleted when their token is removed.

Copy and Share the URL

After creating a temporary login, the secure URL will be displayed. Click Copy to copy it to your clipboard, then share it securely with the intended recipient.

Important: The login URL is only shown once when created. For security reasons, it cannot be retrieved later. If you need to grant access again, create a new temporary login.

Managing Temporary Logins

Active Temporary Logins Table

The table displays all temporary logins with the following information:

• User – The user account the login provides access to
• Created – When the login was created and by whom
• Expires – Expiration date and time remaining
• Status – Active, Disabled, or Expired
• Uses – Number of successful logins with this URL
• Notes – Any notes you added when creating the login
• Actions – Copy, Enable/Disable, Delete buttons

Available Actions

• Copy URL – Copy the login URL to clipboard (active tokens only)
• Disable – Temporarily disable a login without deleting it
• Enable – Re-enable a previously disabled login
• Delete – Permanently remove the login (optionally delete temp user too)

Login Activity Log

The Login Activity Log section shows the last 50 login attempts, including:

• Date/Time – When the login attempt occurred
• User – Which user account was accessed
• IP Address – The IP address of the login attempt
• User Agent – Browser/device information
• Status – Success or Failed (with failure reason)

Failed attempts are logged with reasons such as “Token expired”, “Token disabled”, “Token not found”, or “Invalid token format”.

Use Cases

Developer Access

Grant a developer temporary admin access to debug an issue without sharing your password. Set a short expiry (24-48 hours) and add notes about the specific issue they’re working on.

Support Team Access

Allow a support technician to log in and troubleshoot problems. Create a temporary user with limited role permissions rather than granting admin access.

Client Demo Access

Share access with a client to preview changes before launch. Use the custom redirect URL to send them directly to the relevant page.

Content Collaboration

Allow guest writers or collaborators temporary Editor access to submit content without creating permanent accounts.

Security

Secure Token Design

Temporary login URLs use a selector/validator pattern for maximum security:

• The token is split into a selector (for lookup) and validator (for verification)
• Only the bcrypt hash of the validator is stored in the database
• Even if the database is compromised, attackers cannot reconstruct valid login URLs
• Tokens are generated using cryptographically secure random bytes

Best Practices

• Set the shortest reasonable expiry time for the task
• Use temporary users with limited roles when possible
• Share URLs through secure channels (encrypted email, secure messaging)
• Delete or disable logins when no longer needed
• Regularly review the activity log for unexpected access
• Add descriptive notes to track why each login was created

Automatic Cleanup

The function automatically cleans up old data to keep your database tidy:

• Tokens expired more than 30 days ago are automatically deleted
• Login logs older than 30 days are removed
• Temporary users with no remaining tokens are automatically deleted
• Cleanup runs daily via WordPress cron

Permissions

The Temp Logins (VT) admin page requires the create_users capability, which is available to:

• Administrators (single site)
• Super Admins (multisite)

This ensures only trusted users can create login URLs that grant access to other accounts.

Troubleshooting

Login URL Not Working

• Check if the token has expired
• Verify the token hasn’t been disabled
• Ensure the URL wasn’t truncated when copying
• Check the activity log for specific failure reasons

Menu Not Appearing

• Verify the function is enabled in Voxel Toolkit → Functions
• Confirm your user has the create_users capability (Administrator role)
• Try clearing your browser cache and refreshing

User Shows as “Deleted”

This indicates the WordPress user account was deleted after the temporary login was created. The token is no longer usable. Delete it and create a new one for a different user if needed.

Already Logged In

If someone clicks a temporary login URL while already logged in to WordPress, they will be redirected to the admin dashboard. They must log out first to use the temporary login URL.