Configure how long Magic Links remain valid, how often users can request them, and how strictly each link can be consumed.
VentraConnect Magic Link includes several controls that affect how a one-time login link is issued and consumed.
This guide covers:
- Link expiry
- Resend throttling
- Maximum attempts
- Optional same-IP enforcement
- Single-use behaviour
- How to test your security configuration
How Magic Link Security Works
A Magic Link gives the person who receives the email a temporary way to authenticate without entering a password.
VentraConnect therefore gives you controls over:
Every successfully used Magic Link is designed to be:
- Single-use — once successfully consumed, the same link cannot be used again
- Time-limited — once the configured expiry period has passed, the link is no longer valid
Link Expiry
Link expiry controls how long a newly issued Magic Link remains valid.
The current VentraConnect setup guidance uses a typical range of 10–30 minutes. The right value depends on how quickly your users are expected to open their email and complete login.
A shorter expiry reduces the amount of time an unused link remains valid. A longer expiry gives users more time to switch apps, devices, or networks before opening the email.
Do not make expiry unnecessarily long. Magic Links are temporary authentication links, so the validity period should remain limited.
Resend Throttling
Resend throttle controls the minimum amount of time that must pass before another Magic Link can be requested for the same email address.
This helps prevent repeated requests from immediately generating more Magic Link emails for the same address.
Choose a value that gives the first email enough time to arrive while still letting a genuine user request another link if delivery is delayed or the first email is missed.
Maximum Attempts
Max attempts limits how many times the same Magic Link can be attempted before it is no longer accepted.
This setting is separate from the link's expiry time. A link can still become unusable before its expiry period if its allowed attempts have already been exhausted.
Same-IP Enforcement
Same-IP enforcement is an optional stricter control.
When it can help
- Adds another condition before an issued Magic Link can be consumed
- Can be useful when you want a stricter Magic Link policy
Be careful with mobile and changing networks. If a user requests the Magic Link on one network and opens it after switching IP addresses — for example, mobile data to Wi-Fi — the link may fail when Same-IP enforcement is enabled.
If your users frequently switch networks between requesting and opening email, leaving Same-IP enforcement disabled may provide a smoother experience.
Single-Use Behaviour
A successfully consumed Magic Link cannot be reused.
Expected behaviour
- The user requests a Magic Link
- The link is valid only within the configured expiry period
- The user successfully signs in with it
- The same link cannot be used successfully a second time
This is why users should request a new Magic Link instead of trying to reuse an older link from their inbox.
Security Settings vs Account-Creation Settings
The settings on this page control the security and lifetime of the Magic Link itself. They do not decide whether Magic Link is allowed to create a new WordPress account.
For account-creation behaviour, see Account Creation & Guardrails and Login Only vs Login & Register.
Test Your Magic Link Security Settings
Recommended test checklist:
- Request a Magic Link for an existing WordPress user
- Open the link before it expires and confirm login succeeds
- Try the same link again and confirm it cannot be reused
- Request another link and leave it unused until after the configured expiry period
- Confirm the expired link is no longer accepted
- Test repeated requests and confirm the resend throttle behaves as expected
- Test repeated attempts against one link and confirm Max attempts is enforced
- If Same-IP enforcement is enabled, test from the same IP first
- If relevant to your users, test what happens when the network/IP changes before the link is opened
Test while logged out. Use a private/incognito window or a separate browser session so an existing WordPress session does not hide the real Magic Link behaviour.
