Menu
iThemes
WordPress Backup, Security & Maintenance
  • Products
    • iThemes Security Pro
    • BackupBuddy
    • Kadence WP
    • Restrict Content Pro
    • iThemes Sync
    • Why buy from iThemes?
  • Bundles
    • Essentials Bundle
    • Plugin Suite
    • WordPress Web Designer’s Toolkit
    • Customer Spotlights
  • Resources
    • Blog
    • WordPress 101 Tutorials
    • WordPress Ebooks
    • Weekly WordPress Vulnerability Report
    • The Ultimate Guide to Starting a Web Design Business
  • Training
    • Upcoming Webinars
    • Free Webinar Library
    • Premium Courses
    • Become a Member
    • Member Login
  • Support
    • Documentation
    • Get Help
    • Product Updates
    • Upgrade Policy
    • Contact
    • Our Mission: Make People’s Lives Awesome
  • Log In
WordPress News and Updates from iThemes
Categories
  • Product Updates
  • WordPress Backup
  • WordPress Block Editor
  • WordPress Ecommerce
  • WordPress for Freelancers
  • WordPress Security
  • WordPress Tutorials
  • WPprosper

New! Make WordPress Security Easy With Passwordless Logins

Written by Michael Moore on September 4, 2019

Last Updated on November 5, 2019

The iThemes Security Pro plugin just added a new way for you to lock down your WordPress site while making it easier for you to log in: Passwordless Logins.

iThemes Security Pro already offers several ways to secure user logins on your WordPress site:

  • The Password Requirement feature prevents the use of a weak password.
  • Using the built-in Have I Been Pwned database check, iThemes Security Pro makes sure the password hasn’t appeared in a known database breach.
  • With iThemes Security Pro, you can require everyone to use Two-Factor Authentication when logging in.

Now iThemes Security Pro has a new login method that allows you to require users to use strong passwords and two-factor authentication without ever entering a password or an extra authentication code.

Current iThemes Security Pro, Plugin Suite & Toolkit customers will find version 6.1.0 of the iThemes Security Pro plugin available as an automatic update from your WordPress dashboard (for licensed sites) or as a manual download from the iThemes Member Panel. Save time by updating all your sites at once from the iThemes Sync dashboard.

Email Magic Link

The Problem With Passwords

If you pay attention to the news surrounding cybersecurity, you have probably heard that all of the major tech companies are on a mission to kill passwords. At first, that may sound a little jarring. As long as there have been computers, we have used passwords to secure them. However, passwords by themselves are not a good way of proving identity, and we can do better.

Why? Password best practices are a hassle to implement and most users aren’t willing to add extra steps to the login process, even if it means verifying their identity in a more secure way. When given a choice, people will all choose convenience over security. The reason why 90% of Gmail users don’t use two-factor authentication is that it adds an extra step in their already busy day. Only 12% of people use a password manager because they are too tired to think about having to manage something else. According to research done by Google, using Two-Factor will prevent 100% of bot attacks and 99% of bulk phishing attacks. We understand why people don’t follow security best practices, but it doesn’t make it any less important.

New! Introducing a Better Way to Secure Your Site: Passwordless Logins

Passwordless login is a new way to verify a user’s identity without actually requiring a password to login. Passwordless login is both safe and simple, increasing the likelihood that the average person will secure their account. Passwordless logins lock down your accounts and are much easier to use than traditional credentials.

You may already be using a form of passwordless login without realizing it. For example, if you are using a thumbprint or Face ID to open your phone, you are using a form of passwordless login. Keep in mind that a passwordless login doesn’t necessarily mean a password isn’t assigned to the user. Your phone still requires you to set a password or a PIN, but you do not need to enter one every time you unlock your phone.

The Passwordless Login method provided by iThemes Security Pro will send you an email with a “magic link,” or a link that will log you into WordPress with a click of a button. This way, the passwordless login requires you to have access to the actual email account associated with the user, providing another layer of security.

Getting Started with WordPress Passwordless Login

 

From your WordPress dashboard, navigate to the iThemes Security Pro menu. You’ll see a new Passwordless Login module.

Enable the Passwordless Login module and then click the Configure Settings button.

Passwordless Login Settings

From the settings screen, several settings are listed:

  • Enable Passwordless Login – Enable to start using the passwordless login method.
  • Passwordless Login Per-User Availability – By default, the passwordless login method is enabled for all users. Changing the default to disabled for all users will require every user to enable the method manually. Set the to Enabled by Default.
  • Allow Two-Factor Bypass for Passwordless Login – The allow two-factor bypass option will give selected users to option to disable two-factor authentication when using the passwordless login method. Note: Users should only bypass two-factor authentication if they have also enabled two-factor authentication for the email account that will receive the Passwordless Login Link. 
  • Passwordless Login Flow – Choose what screen users see first in the passwordless login flow: Method First and Username First. We recommend setting the Passwordless Login Flow to Username First to allow users to send the Magic Link email in two steps. Here are screenshots of the two different Passwordless Login Flow screens for this settings option:
    • Username FirstThe Username First screen allows users to enter their username and email address first before selecting the login method.Magic Link Username 
    • Method First The Method First screen allows users to choose between the traditional Passwordless Login methods before entering a username or email address.Magic Link Method First Screen

How the Passwordless Login Method Works

Now that we have enabled Passwordless Login, it is time to take it for a test drive. The first thing we see on our login page is a place to enter our username or password. Enter your username and then click the Continue button.

Magic Link Username

On the next screen, click the Email Magic Link button to send the email containing the passwordless login link.

Email Magic Link

You will now see a message confirming the email has been sent.

Passwordless Login Check Email

In your email inbox, open the Magic Link email and the Login Now button.

Passwordless Login Email

If you have previously enabled two-factor authentication, you will be asked if you want to Enable or Disable two-factor when using the passwordless login method.

Passwordless Login 2FA Choice

If you choose to disable two-factor when using passwordless logins, you will now be able to log into your WordPress dashboard without entering a password or two-factor code.

Wrapping Up: Better WordPress Login Security with Passwordless Login + Free Ebook

Is sending a login link to my email address safe?

We only recommend using the Passwordless Login feature if you are using two-factor authentication on your email account.

That said, if a malicious actor has access to your email account, they can already tell WordPress to send an email to reset the password. Sending a login link isn’t adding any additional vulnerabilities to your site.

You can still require two-authentication when using a Magic Link to increase the security of the login method.

Who Should Use Passwordless Logins?

We created Passwordless Logins as an alternative to using a weak password and no form two-factor authentication. The goal is to increase adoption of 2fa and secure passwords to make the WordPress community safer.

With that in mind, Passwordless Logins are for people who want to increase the security of their site without sacrificing usability.

With Passwordless Login, WordPress security has never been easier! The New iThemes Security Pro Passwordless Login method lets you increase security without decreasing usability, which is a win for everybody.

We also have a new ebook that unpacks how to get started with passwordless login: Getting Started with Passwordless Login.

In this new ebook, you’ll learn more about the passwordless future and the different methods of passwordless login. We also cover how to add passwordless login to your WordPress website and wow the passwordless login method works in iThemes Security Pro.

Learn more about how to get started with passwordless logins. Download the new ebook: Getting Started with Passwordless Login
Download now

Register for the Webinar: The Passwordless Future of WordPress

In this webinar, Michael Moore will explain why passwords are soon to be a relic of the past and why are all of the major tech companies trying to kill passwords. You will learn how to use the new iThemes Security Pro Passwordless Login method to increase security without sacrificing usability.

The Passwordless Future of WordPress
Thursday, Sept. 12
1:00 – 2:00 p.m. (CT)
Register for the webinar

Get the iThemes Security Pro Plugin Today

iThemes Security Pro, our WordPress security plugin, offers 30+ ways to secure and protect your website from common WordPress security vulnerabilities. With WordPress two-factor authentication, brute force protection, strong password enforcement, and more, you can add an extra layer of security to your website.

Get iThemes Security Pro

Share via:

  • Facebook
  • Twitter
  • LinkedIn
  • More
Other related posts
WordPress Vulnerability Report
WordPress Vulnerability Report – August 3, 2022
WordPress Vulnerability Report
WordPress Vulnerability Report – July 27, 2022
Error Establishing a Database Connection Message
How to Fix The “Error Establishing a Database Connection” Message On Your Website
wordpress vulnerability report
WordPress Vulnerability Report – July 20, 2022

Comments

  1. Nathan Lyle says:
    September 5, 2019 at 10:30 am

    So anyone with the link would be able to access the site? Email is not the most secure thing out there… I regularly see clients who’ve had their email compromised due to inadequate passwords, etc. Am I missing something here in how this work?

    Reply
    • Michael Moore says:
      September 6, 2019 at 12:15 pm

      Hi Nathan,

      Thanks for the question! I have updated the Wrapping Up section to address your concern.

      Reply
  2. Tom Nunamaker says:
    September 5, 2019 at 11:33 am

    Can’t a URL be sniffed? Is this really a secure way to login?

    Reply
    • Michael Moore says:
      September 6, 2019 at 12:29 pm

      Hi Tom,

      Great question!

      Yes, if there is an existing security hole that allows an attacker to intercept communication on your site, they could grab the URL and log into your site.

      You can require two-authentication when using a Magic Link to increase the security of the login method.

      However, this is just the first iteration of Passwordless Login, and we plan to add improvements!

      Reply
  3. John says:
    September 6, 2019 at 4:18 am

    I believe, all this does is move the responsibility to the email client. If the email client isn’t secured, this system is useless. So far, two-factor-authentication is the best and most convenient option. It does require a mobile phone as most of those apps are only available on mobile, but who hasn’t got a mobile?
    I first experienced this solution on an app called Notion. It works on cookies and automatically logs me in for a preset period of time. After that it requires me to check my mail for a new login-code. This is the least secure I can think of and very inconvenient. I work on multiple computers, most without my email setup. So, I get my email on my mobile. As it is a link, it is very inconvenient to get the url into another computer.
    Your solution is a clear no-go for me.

    Cheers
    John

    Reply
    • Michael Moore says:
      September 6, 2019 at 12:11 pm

      Hey John,

      Thanks for the feedback! I am glad that you have found the SECURE workflow that works for you! Security minded people like you make the WordPress community stronger. We have updated the Wrapping Up section to include our who we think should try out the Passwordless Login feature.

      Reply
  4. Henrik says:
    September 6, 2019 at 5:49 am

    Version 6.1.1 breaks the site:

    Fatal error: require_once(): Failed opening required ‘/wp-content/plugins/ithemes-security-pro/pro/magic-links/class-magic-links.php’ (include_path=’/usr/local/phpbin/PEAR/:./’) in /wp-content/plugins/ithemes-security-pro/pro/magic-links/active.php on line 3

    Reply
    • Michael Moore says:
      September 6, 2019 at 12:13 pm

      Hi Henrik,

      My apologies that you have run into an issue on your site. I would suggest reaching out to your support team to get some help troubleshooting the error.

      https://members.ithemes.com/panel/helpdesk.php

      Reply
  5. thomas pi says:
    October 14, 2019 at 9:41 am

    how about using the WebAuthn standard?
    the easiest way would be to login to your site by fingerprint or facecheck.
    any plans from your side to add this real passwordless and emailless login?
    all my best
    thomas

    Reply
  6. Alice says:
    October 22, 2019 at 2:44 am

    Thanks for your useful guide. I want the magic links to expire after a given time. After that, users can’t log in to my site with the link anymore. Does this plugin support that?

    Reply

Respond

Click here to cancel reply.

Get updates on new themes & plugins plus special discounts

About iThemes

  • The Team
  • Contact Us
  • Website Accessibility Statement
  • Sitemap

Resources

  • Blog
  • Documentation
  • WordPress Tutorials
  • Free WordPress Ebooks
  • Free Webinar Library
  • Free Upcoming Webinars
  • iThemes Training
  • Affiliates

Customers

  • Member Panel Login
  • Support
  • FAQs
  • Upgrade Policy
  • Licensing
  • Terms and Conditions
  • Refund Policy

Top Products

  • BackupBuddy
  • iThemes Security Pro
  • iThemes Sync
  • Restrict Content Pro
  • WPComplete
  • WordPress Hosting
  • WordPress Plugins
  • Content Upgrades
  • WordPress Landing Page Plugin
  • BackupBuddy Stash

iThemes Media LLC Copyright © 2022 All rights reserved | Privacy Policy

© 2022 All Rights Reserved.

[class^="wpforms-"]
[class^="wpforms-"]
Share via
Facebook
Twitter
LinkedIn
Mix
Email
Print
Copy Link
Powered by Social Snap
Copy link
CopyCopied
Powered by Social Snap

Get the Ebook: Getting Started with Passwordless Login

Learn more about how to get started with passwordless login for your WordPress website, a new way to simplify the login process with extra security.

  • The passwordless future
  • Different methods of passwordless login
  • Adding passwordless login to your WordPress website
  • How the passwordless login method works
No spam. Unsubscribe anytime.