Guardrails & Account Creation in VentraConnect
Guardrails let Social Login, Magic Link, and Email OTP authenticate existing WordPress users while giving you control over whether an unknown visitor may create a new account from a login form.
What Guardrails do
Without account-creation controls, a login form can accidentally become a public registration surface: an unknown email arrives through Social Login, Magic Link, or Email OTP and a new WordPress user is created.
VentraConnect Guardrails separate signing in an existing user from creating a new user. You can keep modern login methods available to people who already have accounts while directing new users through the registration, checkout, membership, or onboarding flow you actually intend them to use.
Existing user
If the verified email matches an existing WordPress user, VentraConnect can authenticate that user through the enabled method.
Unknown visitor
If no matching WordPress account exists, account creation depends on the method's registration mode, WordPress registration state, and applicable Guardrails.
VentraConnect uses a master control plus method-level controls
Account creation is controlled in layers, and the master account-creation setting has the highest priority.
1) Master account-creation control — highest priority
In VentraConnect → General Settings, the Allow new accounts from default login forms option controls whether VentraConnect login methods may create new WordPress users from standard login surfaces.
When this setting is disabled, VentraConnect methods on standard login forms can only authenticate existing users. New accounts must be created through an intended registration or checkout flow.
2) Method-level registration controls
Magic Link and Email OTP also have their own granular registration mode:
Default WordPress login forms
The master Allow new accounts from default login forms setting is designed to stop normal login surfaces from becoming unintended registration paths.
Your intended registration process still matters
Guardrails do not replace WordPress registration settings. They are designed to prevent account creation from login surfaces you choose to restrict while allowing legitimate registration paths to continue according to their own rules.
Passkeys are not governed by Social / Magic Link / OTP Guardrails
Passkeys follow their own native registration flow. A Passkey is a credential attached to a WordPress user account, and supported Passkey registration is handled separately from the Guardrail logic used by Social Login, Magic Link, and Email OTP.
What Pro adds
VentraConnect Pro extends authentication and account-creation awareness into supported WooCommerce, LMS, membership, and community flows.
Because each integration has its own login and registration behavior, the exact account-creation rule should be documented and tested per integration rather than assumed globally.
A safe starting configuration
- Decide whether your normal login forms should ever create new users.
- If they should authenticate existing users only, disable Allow new accounts from default login forms in General Settings.
- For Magic Link and Email OTP, choose Login Only if that method should never register a user.
- Use Login & Register only when the method is intentionally allowed to create accounts and the master account-creation rule permits it on that surface.
- Keep your intended registration, checkout, or onboarding flow available for legitimate new-user creation.
- Test with both an existing email and a completely new email in a private browser window.
Common questions
Which account-creation setting has the highest priority?
The master Allow new accounts from default login forms setting in General Settings has the highest priority for those login surfaces. If it blocks account creation, Magic Link or Email OTP cannot override it by being set to Login & Register.
Do Guardrails block existing users?
No. The purpose is to let existing users authenticate while controlling whether an unknown visitor can create a new account from that login surface.
Do Guardrails disable WordPress registration?
No. Guardrails do not replace WordPress registration settings. Your intended registration flows continue according to their own configuration.
Do Guardrails apply to Passkeys?
No. Passkeys use a separate native registration and credential flow.
