User-facing guide: Temporary login plugins.

Add custom query parameter names that should count as temporary login links and bypass suspicious query detection. The matching plugin file must be active before the bypass applies.

Parameters

$params (array): List of entries. Each entry can include:
- param (string): Query parameter name
- plugin_file (string): Plugin main file (for example plugin-folder/plugin-file.php)
- requires (array, optional): Extra required parameters (for example Magic Login)
- prefix (bool, optional): If true, match parameters that start with param (dynamic prefixes such as Login Links)

Default supported plugins

wtlwp_token → Temporary Login Without Password
one_time_login_token → One Time Login
magic-login + user_id + token → Magic Login
Parameters starting with ll → Login Links

Example

add_filter('securityninja_temporary_login_params', function($params) {
    $params[] = array(
        'param' => 'my_plugin_login_token',
        'plugin_file' => 'my-plugin/my-plugin.php'
    );
    return $params;
});

Multiple required parameters

add_filter('securityninja_temporary_login_params', function($params) {
    $params[] = array(
        'param' => 'my_login',
        'plugin_file' => 'my-plugin/my-plugin.php',
        'requires' => array('user_id', 'token')
    );
    return $params;
});

Dynamic prefix

add_filter('securityninja_temporary_login_params', function($params) {
    $params[] = array(
        'param' => 'my_prefix',
        'plugin_file' => 'my-plugin/my-plugin.php',
        'prefix' => true
    );
    return $params;
});

Security note

The plugin file is checked with is_plugin_active() before checks are bypassed. That stops someone from using a parameter name without the real plugin installed.

Filter: securityninja_temporary_login_params