Temporary Login

Summarize with AI

Temporary Login lets you share a one-click, time-limited sign-in link instead of handing over a real password. Links use a ?tl_token= query parameter, expire on their own, and leave a short activity trail you can review.

What it does

Adds a dedicated admin page: WP PowerSuite -> Temporary Login (powersuite-temporary-login).
Creates token links that log the assigned user in when opened (?tl_token=...).
Stores logins and activity in database tables tl_temporary_logins and tl_activity_logs.
Free: new links are limited to 1-day expiry only.
Pro: longer/custom expiry, single-use, max uses, IP restriction, and bind to first device.
Can bypass WP PowerSuite 2FA for a valid token matching that user. During the session, privileged accounts cannot be exempted from 2FA.
Blocks sensitive admin screens during a temporary session (plugin/theme editors, core updates, import/export, site health).
Blocks PowerSuite pages and settings that persist after the link expires: Temporary Login management, License, Code Snippets, Email Delivery, WP Config Editor, Header & Footer Code, Alpine.js, Quick Debug, and Login as User settings.
If the visitor uses Login as User, the temporary session stays locked down. They cannot switch into a privileged administrator account. Switch-back ends the visit if the temporary login is no longer valid.

When to use it

A developer or host needs short-lived admin access without your password.
A client or vendor should review the site for a day without a permanent account password.
You want an activity trail of temporary access.

When not to use it

How to enable it

Go to WP PowerSuite -> Modules.
Filter by Login & Users or search for “Temporary Login”.
Turn the module on.
Open WP PowerSuite -> Temporary Login to create and manage links.

There is no gear-icon settings modal - management is on the custom admin page.

How to test it

Create a temporary login for a test user (Free: 1-day expiry).
Copy the link and open it in a private browser window while logged out. ✅ You are signed in as that user without entering a password.
Confirm blocked screens (e.g. plugin editor) are inaccessible.
After expiry (or revoke), reopen the link - access should be denied.
Check activity on the Temporary Login admin page.

Troubleshooting

Link does nothing / access denied. Token may be expired, revoked, over max uses, IP-mismatched (Pro), or device-mismatched (Pro).
Can’t create longer expiry on Free. Expected - Free forces 1-day; activate WP PowerSuite Pro for other durations.
2FA still prompts. Bypass only applies when the token is valid and matches the user being authenticated.
Can’t open Temporary Login while using a temp session. Expected - that PowerSuite page is blocked during temporary sessions.
WP Config Editor / Code Snippets / Email Delivery blocked. Expected - temporary sessions cannot change how code runs or how mail is sent.
Login as User still feels restricted. Expected - impersonation does not lift the temporary session. Privileged administrator accounts stay off limits.

Manage with WP-CLI

Prefer the command line? You can turn this module on or off with WP-CLI instead of the dashboard:

# Turn the module on
wp powersuite module enable temporary-login

# Turn the module off
wp powersuite module disable temporary-login

# Check whether it is on, its category, and where its settings live
wp powersuite module get temporary-login

Managing more than one site? Add --url=https://example.com to point a command at one site. If this is a Pro module, install WP PowerSuite Pro and activate your license first. New to WP-CLI? See the full command guide.

FAQ

What does the free Temporary Login tier allow?

On the free plugin, new links use a 1-day expiry only. Single-use, max uses, IP restriction, device binding, and longer/custom expiries require WP PowerSuite Pro.

Does Temporary Login bypass two-factor authentication?

Yes. A valid temporary login token for that user can bypass WP PowerSuite 2FA for that sign-in. During the session, a vendor cannot exempt privileged accounts from 2FA.

Where do I manage temporary logins?

Under WP PowerSuite -> Temporary Login (admin.php?page=powersuite-temporary-login).

Can temporary sessions edit plugins or themes?

Sensitive screens such as the plugin/theme editors, update-core, import/export, and site health are blocked. Temporary Login, License, Code Snippets, Email Delivery, and WP Config Editor are also blocked. Changes that persist after the link expires stay with the site owner.

What happens if a temporary session uses Login as User?

The temporary session stays in effect. The vendor cannot switch into a privileged administrator account, and switch-back ends the visit if the temporary login is no longer valid.

Developer notes (hooks & filters)

Source: modules/temporary-login/module.php, FeatureGate.php, admin.php. Boot: critical. Meta: is_freemium, has_custom_page.

Token query param: tl_token.
Tables (with $wpdb->prefix): tl_temporary_logins, tl_activity_logs.
Session cookie: wpps_tl_session.
Free gating: FeatureGate::applyFreeTierCreateArgs() forces expiry_type = day, clears single-use / max uses / IP / bind_user_agent.
2FA: wpps_2fa_allow_bypass via allow2FABypassForTemporaryLogin.
Always-blocked admin screens include plugin-editor.php, theme-editor.php, update-core.php, import.php, export.php, site-health.php.
Blocked PowerSuite pages during temp session: powersuite-temporary-login, powersuite-license, plus TemporarySessionGuard pages powersuite-code-snippet and powersuite-email-delivery.
Blocked module settings during temp session: code-snippet, wp-config-editor, header-footer-code, alpine-js-enqueue, quick-debug-toggle, email-smtp, login-as-user.
Login as User keeps the wpps_tl_session cookie so restrictions persist after impersonation; switch-back remints or ends the temp session.
Filter: wpps_tl_is_token_login_request.