← Magic Link Login

Magic Link Login Documentation

BSM Magic Login provides passwordless authentication for
WordPress. Users can sign in using secure email magic links
instead of traditional passwords. The Pro edition adds SMS
authentication, multiple SMS providers, and advanced IP
security controls.

1. System Requirements

• WordPress 6.4 or newer
• PHP 8.0 or newer
• HTTPS-enabled WordPress installation
• Working WordPress email delivery
• An existing WordPress user account
• For SMS authentication: BSM Magic Login Pro,
  a supported SMS provider, and a verified mobile number

An SMTP email service is recommended to improve
authentication email delivery.

2. Installation

1. Download the BSM Magic Login ZIP package.
2. Sign in to your WordPress administration dashboard.
3. Navigate to Plugins > Add New Plugin.
4. Click Upload Plugin.
5. Select the downloaded ZIP file.
6. Click Install Now.
7. Activate BSM Magic Login.

After activation, locate Magic Login in the WordPress
administration menu.

If upgrading an existing installation, use the WordPress
plugin replacement process. Back up your website and
database before performing major updates.

3. Initial Configuration

Navigate to Magic Login > Settings to configure
authentication behavior.

Email Authentication

Configure the email magic-link authentication settings
before making the login form available to members.

• Link expiration:
  Determines how long an issued authentication link
  remains valid. The default is 15 minutes.
• Request limits:
  Restrict how frequently authentication emails
  can be requested.
• Resend cooldown:
  Prevent repeated email requests within a
  short period.
• Login redirect:
  Configure the destination after successful
  authentication.
• Eligible user roles:
  Control which WordPress users can authenticate
  through magic links.

Recommended initial configuration:

• Link expiration: 15 minutes
• Maximum email requests: 3 per hour per email
• Maximum requests per IP: 10 per hour
• Resend cooldown: 60 seconds
• Single-use authentication links

Review these settings based on your site's traffic
and security requirements.

4. Creating a Passwordless Login Page

BSM Magic Login provides a shortcode for displaying
the authentication interface on the front end.

[bsm_magic_login]

Installation Instructions

1. Navigate to Pages > Add New.
2. Create a page named Passwordless Login.
3. Insert a WordPress Shortcode block.
4. Add the BSM Magic Login shortcode.
5. Publish the page.
6. Test authentication with an existing user account.

Using Divi

When using Divi, add the shortcode through a Code
or Text module that supports WordPress shortcode
execution.

The authentication form can be incorporated into
an existing login page or placed on a dedicated page.

5. How Email Magic Links Work

1. The member opens the passwordless login page.
2. The member enters their registered email address.
3. The plugin generates a secure authentication token.
4. An email containing the authentication link
   is sent to the member.
5. The member opens the link.
6. The authentication request is validated.
7. The member completes the login confirmation
   when prompted.
8. WordPress establishes the authenticated session.

Authentication links are single-use and expire
automatically. Requesting a replacement link
invalidates the previous outstanding link.

For security, requesting authentication does not
publicly disclose whether an email address belongs
to an existing WordPress account.

6. BSM Magic Login Pro

BSM Magic Login Pro extends email authentication
with SMS one-time passcodes and advanced security
management.

A valid Pro entitlement is required to enable
Pro functionality.

Activating Pro

1. Open Magic Login > License.
2. Enter your BSM Strategy license key.
3. Activate and validate the license.
4. Confirm that the license status is active.
5. Configure the additional Pro features.

The License page displays license status,
expiration information, validation controls,
and connection diagnostics.

7. Configuring SMS Authentication

SMS authentication is available in BSM Magic
Login Pro.

The plugin supports the following SMS providers:

• Plivo
• Twilio
• Telnyx
• Amazon Web Services SNS
• Bird / MessageBird

Adding an SMS Provider

1. Open the SMS provider management interface
   in Magic Login.
2. Select Add Provider.
3. Enter a descriptive connection name.
4. Select the SMS service.
5. Complete the provider-specific configuration.
6. Save the connection.
7. Test SMS delivery.
8. Enable the connection.
9. Designate the default SMS provider.

The configuration fields depend on the selected
provider. Obtain the required credentials from
your provider account.

Plivo

Create or configure a Plivo account and obtain
the messaging API credentials.

Typical requirements include:

• Plivo Auth ID
• Plivo Auth Token
• Approved SMS sender

Complete any applicable sender registration
requirements before enabling production delivery.

Twilio

Configure a Twilio account with SMS messaging
capabilities.

Typical requirements include:

• Twilio Account SID
• Twilio Auth Token
• SMS-capable sender or configured messaging service

Confirm that your Twilio account is authorized
to send messages to the intended destinations.

Telnyx

Configure a Telnyx messaging profile and
obtain the appropriate API credentials.

Typical requirements include:

• Telnyx API key
• Messaging profile
• Approved sender configuration

Amazon Web Services SNS

Configure Amazon SNS SMS messaging within
your AWS account.

Typical requirements include:

• AWS region
• Appropriate AWS API credentials
• SMS origination configuration
• Required IAM permissions

Use credentials with the minimum permissions
necessary for SMS delivery.

Bird / MessageBird

Configure a Bird account with SMS capabilities
and obtain the credentials required by the
plugin's Bird integration.

Complete the sender configuration and any
applicable messaging registration requirements.

8. Managing SMS Provider Connections

BSM Magic Login Pro supports multiple SMS
provider connections.

Administrators can manage connections using
the following operations:

• Add:
  Create a new provider connection.
• Edit:
  Update an existing connection.
• Test:
  Verify SMS delivery using the configured provider.
• Enable/Disable:
  Control connection availability.
• Set Default:
  Select the primary connection.
• Duplicate:
  Create another connection based on an existing one.
• Delete:
  Remove an unwanted connection.

Before deleting the default connection,
configure an alternative provider if SMS
authentication must remain available.

Provider account charges are separate from
the BSM Magic Login Pro license.

9. SMS Login Configuration

SMS authentication uses randomized six-digit
one-time passcodes.

Recommended configuration:

• Code length: 6 digits
• Code expiration: 5 minutes
• Maximum verification attempts: 5
• Resend cooldown: 60 seconds
• Maximum SMS requests per phone: 5 per hour
• Maximum SMS requests per IP: 10 per hour
• Only the newest outstanding code remains valid
• Each code can be used once

These values are the recommended defaults.
Review the available settings before deployment.

SMS Login Process

1. The member requests SMS authentication.
2. The plugin identifies the associated
   WordPress account.
3. An authentication code is sent to the
   verified mobile number on file.
4. The member enters the six-digit code.
5. The plugin validates the code and
   checks its expiration and attempt limits.
6. WordPress authenticates the member
   when verification succeeds.

SMS authentication requires a verified mobile
number associated with the member's account.

10. Managing Member Mobile Numbers

Mobile numbers must be associated with the
appropriate WordPress user account before
SMS authentication can be used.

Administrators can review the mobile number
and SMS verification status through the
available user-profile controls.

Store mobile numbers using international
E.164 formatting.

Example:

+12125550123

A newly entered or changed phone number
should not be trusted as an authentication
credential until ownership has been verified.

If a member changes their telephone number,
reverify the new number before permitting
SMS authentication.

11. Authentication Activity Logs

Navigate to Magic Login > Activity to
investigate authentication events.

The administrative activity log records
information associated with authentication
requests and security events.

Available information includes:

• Event timestamp
• WordPress user information
• Full email address
• Source IP address
• Authentication method
• Request and authentication events
• Expired authentication attempts
• Rate-limit events
• SMS provider information, when applicable
• Authentication results

Authorized administrators can use the activity
log to investigate suspicious authentication
attempts and troubleshoot login problems.

Actual authentication tokens and SMS
verification codes are not included
in the audit log.

12. IP Blocking and Abuse Protection

BSM Magic Login Pro provides advanced
IP blocking and authentication-abuse controls.

Manual IP Blocking

Administrators can create manual IP blocks
through Magic Login > IP Blocks.

Supported blocking options include:

• Individual IPv4 addresses
• Individual IPv6 addresses
• CIDR network ranges
• Temporary blocks
• Permanent blocks

Use CIDR blocking carefully. Blocking an entire
network may prevent legitimate users from
authenticating.

Automatic Abuse Protection

Configure automatic abuse controls to limit
repeated invalid authentication attempts.

Automatic temporary blocking can help reduce
repeated attacks without requiring administrators
to manually investigate every failed request.

Review blocked IP addresses periodically,
especially when members use shared networks,
corporate connections, or mobile networks.

13. License Management

BSM Magic Login uses the BSM Strategy
licensing system.

Navigate to Magic Login > License to
manage your installation's license.

Available License Operations

• Activate a Pro license
• Replace an existing license
• Validate Now
• Review license status
• Review expiration information
• Review license diagnostics
• Deactivate or remove a license

License Expiration

BSM licensing provides a seven-day
post-expiration allowance during which
Pro functionality remains available.

After the allowance expires, Pro features
require successful license renewal
and validation.

Removing a license immediately disables
the associated Pro entitlement.

An authoritative license revocation
immediately disables Pro functionality.

Temporary validation-service failures
are handled separately from an
authoritative license rejection.

14. Free and Pro Feature Comparison

15. Troubleshooting

Magic Link Email Not Received

1. Confirm the member's email address.
2. Check the recipient's spam folder.
3. Verify WordPress email delivery.
4. Review authentication activity.
5. Check email request limits.
6. Review SMTP configuration if applicable.

Authentication Link Expired

Request a new authentication link.
Previously expired links cannot be reused.

Authentication Link Already Used

Each magic link is single-use.
Request another link to start a new
authentication session.

SMS Code Not Received

1. Verify the member's mobile number.
2. Confirm that the number is verified.
3. Check the active SMS provider connection.
4. Send a test SMS.
5. Review provider account restrictions.
6. Check request limits and activity logs.

SMS Provider Authentication Failure

Verify the provider credentials and
sender configuration.

Review the provider's own messaging logs
for additional delivery and API diagnostics.

Pro Features Unavailable

1. Open Magic Login > License.
2. Review the license status.
3. Select Validate Now.
4. Review any reported API errors.
5. Confirm the license is valid for this product.

Administrator Locked Out

Preserve an independent administrator
recovery method before enabling
passwordless authentication for all users.

If authentication configuration prevents
administrator access, use your hosting
provider's recovery tools or WordPress
command-line access to disable the plugin
temporarily.

16. Frequently Asked Questions

Does Magic Login replace WordPress passwords?

No. Magic Login provides an alternative
authentication method using existing
WordPress user accounts.

Can users sign in without a password?

Yes. Eligible users can authenticate
using email magic links. Pro users
can additionally use SMS authentication.

Can I use Magic Login with Divi?

Yes. Add the Magic Login shortcode
to a Divi page using a compatible module.

Do I need Pro for email magic links?

No. Email magic-link authentication
is included in the Free edition.

Do I need an SMS provider account?

Yes. SMS authentication requires an
account with a supported provider.
Provider charges are billed separately.

Can I configure multiple SMS providers?

Yes. Pro supports multiple provider
connections and allows administrators
to designate the default connection.

Can administrators see complete IP addresses?

Yes. Authentication activity is designed
to provide authorized administrators
with security and troubleshooting information.

Are authentication codes stored in logs?

No. Actual magic-link credentials and
SMS one-time passcodes are not
included in the activity log.

Can I block suspicious IP addresses?

Yes. Pro provides manual IP and CIDR
blocking along with automatic abuse controls.

What happens when my Pro license expires?

The BSM licensing system provides a
seven-day post-expiration allowance.
Afterward, Pro functionality requires
renewal and successful validation.
Free functionality remains available.

17. Security Recommendations

• Use HTTPS throughout your website.
• Keep WordPress and plugins updated.
• Use a reliable transactional email service.
• Maintain appropriate authentication limits.
• Restrict access to administrative audit logs.
• Verify mobile numbers before enabling SMS login.
• Protect SMS provider credentials.
• Review suspicious authentication activity.
• Maintain an independent administrator recovery method.
• Back up your website regularly.

SMS authentication relies on the security
of the associated telephone number and
mobile carrier. For highly sensitive
administrator accounts, consider
phishing-resistant multifactor authentication.

18. Support and Updates

BSM Magic Login is developed and
maintained by BSM Strategy.

Product information:

BSM Magic Login

Documentation:

BSM Magic Login Documentation

Technical support:

BSM Magic Login Support

Before requesting support, record your
installed plugin version, WordPress version,
PHP version, relevant activity-log events,
and any available diagnostic error messages.

Never include license keys, SMS API secrets,
magic-link credentials, or authentication
passcodes in support requests.

Need help? Visit Support & FAQ