Filter: securityninja_is_temporary_login_link

User-facing guide: Temporary login plugins.

Override temporary login link detection. Return true to bypass suspicious query checks, false to run checks, or null to keep the default detection.

Parameters

• $is_temporary_login (bool|null): Current result (null means default detection has not decided yet)
• $request_uri (string): Request URI
• $query_string (string): Query string

Return values

• true: Bypass suspicious query checks (treat as temporary login)
• false: Run suspicious query checks
• null: Use built-in parameter checking

Example: simple override

add_filter('securityninja_is_temporary_login_link', function($is_temporary_login, $request_uri, $query_string) {
    if (strpos($query_string, 'custom_token=') !== false) {
        return true;
    }
    return $is_temporary_login;
}, 10, 3);

Example: custom detection

add_filter('securityninja_is_temporary_login_link', function($is_temporary_login, $request_uri, $query_string) {
    if (preg_match('/myplugin_token=[a-zA-Z0-9]{64}/', $query_string)) {
        if (is_plugin_active('my-plugin/my-plugin.php')) {
            return true;
        }
    }

    if (strpos($request_uri, '/special-login/') !== false && isset($_GET['auth_code'])) {
        return true;
    }

    return $is_temporary_login;
}, 10, 3);

Example: force checks for a pattern

add_filter('securityninja_is_temporary_login_link', function($is_temporary_login, $request_uri, $query_string) {
    if (strpos($query_string, 'eval(') !== false) {
        return false;
    }

    return $is_temporary_login;
}, 10, 3);

When to use this filter

• Your plugin uses query parameter names that do not match the built-in list
• You need validation beyond simple parameter presence
• You want URL-based or other request-based conditions
• You integrate with plugins that have unusual auth flows

Security notes

• Verify the plugin is active before bypassing checks
• Validate token formats
• Consider rate limiting for custom temporary login links
• Log custom detections when you need an audit trail
• Return false for suspicious patterns even if they resemble your plugin’s format