Create & Manage WordPress Temporary Login Access for Users

Granting temporary access to developers or collaborators is a common need for WordPress site owners. However, managing these accounts can quickly turn into a security headache—not to mention it being a time-suck. Weak passwords, forgotten deletions, and manual processes leave your site vulnerable and leave you spending far too much time managing user accounts. 

Fortunately, there’s a better way. In this guide, we’ll explore how a plugin can make creating and managing temporary users easier and more secure.

A WordPress temporary login is a great way to give users such as developers and freelancers limited access to your WordPress site. It enables us to follow the principle of least privilege while

Why Would You Need to Give Temporary Access to Your WordPress Site?

Temporary access minimizes security risks by ensuring third parties don’t keep unnecessary access to your website. This helps reduce security risks caused by unused accounts. 

There are many situations where you might choose to give temporary access instead of creating a new account, including:

• Safely giving a developer access to troubleshoot a plugin issue
• Giving a graphic designer access for design updates
• Letting a shop manager check inventory
• Granting an editor access to review a blog post

In all these situations, giving temporary access instead of a new account ensures they can do their job while limiting potential risk.

The Problem – Manually Creating & Managing Temporary Users on WordPress

The process of creating a new user on WordPress isn’t a big deal – you just have to specify an email address and the username. Then an email, including the password, is automatically sent to the recipient. However, the problems start afterward, and get worse when you have multiple temporary users.

Key Challenges with Temporary WordPress Users

• Weak passwords: Temporary accounts, often with admin access, are initially set up with strong passwords. However, third parties frequently change these to weaker, easy-to-remember ones, compromising security. There are steps you can take to overcome this, like using a login security plugin, but it’s still an important challenge to consider. 
• Forgetting to delete users: Temporary accounts are rarely deleted on time. Many WordPress sites accumulate unused accounts, leaving them vulnerable to breaches caused by weak passwords or stolen credentials.
• Unmonitored account activity: Temporary users often operate without any form of tracking or oversight. When there are multiple accounts on the site, this makes it nearly impossible to identify which account made which change. 
• Manual management challenges: Relying on manual processes to create, manage, and delete temporary accounts can be time-consuming. The more accounts on the site, the more work goes into managing them.

The Solution – A Plugin to Create Temporary Users

To eliminate the issues related to temporary users, most people opt for a plugin. Melapress Login Security, a plugin we develop ourselves, offers a temporary login feature that’s also included with the free version of the plugin. It includes several options to ensure temporary logins remain as secure as possible.

Creating a Temporary WordPress Login

Once you install and activate the plugin, navigate to Login Security > Temporary Login and then click on the Create temporary login button.

Here you will need to provide details such as:

• The email address
• First name and last name
• The role you want to assign the user to
• Where you want to redirect the user after the log in
• When and how the user account expires
• The maximum number of logins
• Account language
• Whether you want to send an email with the link or not

Once you’ve made your selections, you’ll need to click on the Create login link button to finish.

The temporary login link

After clicking submit, you get a temporary login link to share with whoever you want to give temporary access to. This temporary link will be valid for the duration you set and looks like this:

https://melapresss.com/wp-admin/?mls_temp_user_token=b4cc27c42c54b2ffcb533f441a4856ka1aee7283ccf90d9594a4d8f90694a90da4810c2b8d4db3642150e9376495d6329cdf0bccfa25acg245c3O598e3a88e0b

When the user clicks on the created login link, he or she is automatically logged in to your site on a temporary login account. If they log out by mistake, clicking on the link again will restore their session.

Configuring the WordPress User Role and Expiration

From the WordPress security point of view, this is a perfect solution:

• It allows you to set the role, which is very important because you should never give WordPress users more privileges than they need.
• You can set an expiry date, which means you will not need to remember to delete the account. Therefore, should the recipient’s email account get hacked, malicious users cannot use the link to log in to your WordPress because it is temporary.

When setting the expiration for the link, you can select any of the predefined options or simply specify a date.

Managing Multiple Temporary WordPress Logins

All the temporary WordPress users you create with the plugin can be managed from the same Temporary Logins menu.

As you can see in the above screenshot, you can copy the login link to the clipboard or email the link to the user with just a mouse click. You can also disable and delete any of the temporary logins by hovering over the account. So, if you ever have any concerns about the activity of one of the users, you can use these options to revoke their access.

Keeping Log of What Temporary WordPress Users Are Doing

When you give temporary access to a third party, you need to keep an eye on their activity. They could accidentally do something they shouldn’t that harms your website, or their email could get hacked, giving a bad actor access to your site. Monitoring temporary user activity and identifying potential issues before they harm your site is very important.

Our WP Activity Log plugin does just that, and it’s fully compatible with the Temporary Login without Password WordPress plugin.

For example in the screenshot below, we can see that the temporary WordPress user Anekke has created and published a new post, changed its URL, and uploaded a media file.

WP Activity Log can keep a record of any type of change on your WordPress websites and multisite networks, including those made by temporary users. This includes changes to posts, pages, custom post types, plugins, themes, user profiles, menus, widgets, and global WordPress settings changes, just to name a few.

Refer to the complete list of WordPress changes that the WP Activity Log plugin can keep a record of for more information.

Giving Temporary Access To Your WordPress & Monitoring Changes Just Got Easier

Temporary logins with Melapress Login Security provide an easy-to-use solution that reduces the drudgery and security risks that come with creating temporary WordPress users for third parties. This solves a whole host of problems, but it’s still important to monitor changes made by these users.

The WP Activity Log plugin does just that, allowing you to ensure the temporary accounts can be managed in a secure fashion. Together, they make giving and managing temporary access a whole lot easier.