Agencies often send contractors or support staff a one-time login link instead of a password. Those URLs use query tokens that can look like exploit patterns to a request firewall.
Security Ninja recognizes the plugins below and allows their login links through when the matching plugin is active on the site.
Supported plugins
- Temporary Login Without Password
- One Time Login
- Magic Login
- Login Links
The plugin must be installed and activated. A random token parameter on a site without that plugin is still blocked.
What Security Ninja does
- Filter Suspicious Queries skips the 8G request checks for that login link, so the URL is not treated as a bad query.
- Change login URL (Rename Login, Pro) lets the first
wp-adminrequest through so the temporary-login plugin can finish signing the person in. - The Events Logger records a successful login as temporary login and includes the plugin name.
This is separate from login form protection (failed-password lockouts). A blocked magic or temp link is usually the query filter or rename login, not the auto-ban rules.
Other temporary-login plugins
Other plugins are not recognized automatically. Developers can add parameters or override detection:
securityninja_temporary_login_paramssecurityninja_is_temporary_login_linksecurityninja_rename_login_allow_autologin(Rename Login only; returntrueto allow the current request through the wp-admin gate)
