Description
Temporary Login Without Password & Secure Access for WordPress
Secure Access Bridge helps you create secure, temporary, one-click login links. Grant dashboard access to developers, clients, SEO specialists, and support teams without sharing administrator passwords.
Stop sending real WordPress passwords by email or chat. Use passwordless temporary login links with expiry rules, access profiles, activity logs, and change recovery instead.
Ideal for agencies, freelancers, site owners, and helpdesk teams who need safe temporary WordPress admin access.
🚀 Key Features for Temporary Login
- One-Click Temporary Login: Generate secure access links instantly without requiring users to type a password.
- Passwordless Access: Provide full or restricted WordPress access without ever exposing sensitive user credentials.
- Smart Access Profiles: Choose from predefined roles (Support, Developer, Client, Designer, SEO) or build custom profiles for precise control.
- Granular Security Restrictions: Limit temporary access by:
- Allowed menus & capabilities
- IP address & Country code
- Device type & Browser
- Session duration & Idle timeout
- Full Activity Audit Trail: Track every critical action performed by temporary users to ensure complete accountability.
- Change Recovery (Snapshots): Automatically create recoverable snapshots of content changes so you can review and restore if a temporary user makes a mistake.
- QR Code Login Support: Display a scannable QR code for instant mobile login access.
- Webhook Notifications (Slack/Discord): Get instant alerts via webhooks whenever a temporary login is used or critical actions are performed.
- Stealth Mode (White-label): Hide the plugin menu completely and access it only via a secret URL parameter.
- Automatic Data Cleanup: Automatically delete expired login links and session data to keep your database fast and clean.
💡 Why Do You Need Secure Access Bridge?
Sharing your admin password via email or chat is extremely dangerous. Creating a new permanent user account for a quick 1-hour support task creates unnecessary clutter and long-term security vulnerabilities.
Secure Access Bridge is perfect when you need to:
* Give a plugin or theme developer temporary access to troubleshoot a bug.
* Let a client safely review their website before launch.
* Provide an SEO expert restricted access to update meta tags.
* Keep a clear audit log of what a temporary user did on your site.
* Ensure maximum WordPress security by enforcing session expirations.
🔒 Built With Privacy and Security in Mind
Unlike other temporary login plugins, Secure Access Bridge hashes all generated access tokens before saving them to your database. The plain token is only generated once for the admin to copy.
Furthermore, this plugin contains ZERO tracking, telemetry, or hidden advertising code. Your data stays on your server.
External services
This plugin can connect to external services only for specific optional features.
QRServer / goQR.me
The plugin uses the QRServer API from goQR.me to generate QR code images for temporary login links.
When a QR code is displayed, the generated temporary login URL is sent to the QRServer API as the QR code data. The plugin does not send WordPress passwords, site content, or payment information to QRServer.
Service provider: QRServer / goQR.me
Terms: https://goqr.me/api/doc/
Privacy policy: https://goqr.me/de/rechtliches/datenschutz-goqrme.html
Screenshots
Installation
- Upload the
secure-access-bridgefolder to the/wp-content/plugins/directory, or install the ZIP through Plugins > Add New > Upload Plugin. - Activate Secure Access Bridge from the WordPress Plugins screen.
- Open Secure Access Bridge from the admin menu.
- Click “Create Link”, select a profile (e.g., Developer or Support), configure expiry, and share the generated link securely.
FAQ
-
No. Secure Access Bridge generates a unique URL that bypasses the standard login screen entirely. Your actual WordPress password is never shared, exposed, or changed.
-
How secure are the temporary login tokens?
-
Extremely secure. Generated access tokens are cryptographically hashed before being stored in your database. Even if your database is compromised, the temporary login URLs cannot be extracted or reversed.
-
Absolutely! You can use predefined access profiles or configure custom rules to restrict allowed menus, specific capabilities, and even restrict access by country or IP address.
-
Can I manually revoke a temporary login link?
-
Yes. Administrators can instantly revoke or delete any active temporary access link from the plugin dashboard with one click.
-
Does the plugin support QR code logins for mobile?
-
Yes. You can generate a QR code for the login URL, allowing users to scan and log in directly from their mobile devices. (QR codes are generated securely via the external QRServer service).
-
What happens when a session expires?
-
The temporary user is instantly logged out of WordPress, and the link becomes invalid.
-
What happens if I deactivate or uninstall the plugin?
-
If deactivated, all temporary login links will instantly stop working. If you completely uninstall the plugin, all custom database tables, options, and logs are safely removed from your site.
-
Can I use country restrictions without a GeoIP service?
-
Country checks read CDN/proxy headers such as Cloudflare CF-IPCountry. The plugin does not call an external GeoIP API. Without those headers the country is treated as Unknown, and any link with country restrictions will deny access. Use the testing Simulate Country Code setting only on staging.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Secure Access Bridge” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Secure Access Bridge” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.0.2
- Security/Performance: Added shared-host friendly email rate limits (default 20/hour, max 50/hour, burst 5/minute) so low servers cannot flood mail queues.
- Security: Hardened email sender headers and validated login URLs before email delivery.
- Security: Stealth-mode cookie now uses HttpOnly + SameSite=Lax and constant-time token compare.
- Performance: Deferred heavy activity/recovery hooks to temporary users only; cached temp-user capability checks; throttled session activity DB writes.
- Fix: Unified link/session/log datetimes to WordPress local time (fixes wrong expiry on non-UTC sites).
- Fix: Change Recovery now tracks all temporary login sessions (not only dummy users).
- Fix: Safer IP detection defaults; optional proxy trust via filter.
- Enhancement: Restriction arrays stored as JSON going forward, with backward-compatible read for legacy serialized rows.
- Compatibility: Added upgrade migrator so existing installs keep settings/tables/cron intact when updating.
- Docs: Clarified country restrictions need CDN/proxy GeoIP headers (e.g. Cloudflare CF-IPCountry).
- Tweak: Cron scheduling moved off every page load; expired cleanup runs in small batches.
1.0.1
- Enhancement: Massive SEO improvements in plugin description and metadata.
- Feature: Added full translation support with POT file and 10 default languages (bn_BD, de_DE, fr_FR, es_ES, it_IT, pt_BR, nl_NL, ru_RU, ja, ar).
- Tweak: Refactored and improved UI text to be more user-friendly.
1.0.0
- Initial release of Secure Access Bridge.