HappyAccess - Temporary Login, Passwordless Login and 2FA
| 开发者 | shameemreza |
|---|---|
| 更新时间 | 2026年10月10日 11:34 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- Temporary login: give a support person, developer or agency access to your site with a link or a code that ends by itself. No password shared, no account left behind.
- Passwordless login: let customers and users log in with a 6-digit code or a login link sent to their email. It works on the WordPress login page, WooCommerce My Account and checkout.
- Two-step login (2FA): ask for a code from an authenticator app, an email code or a backup code after the password, and require it for the roles you pick.
- You pick how long: 1 day, 3 days, 7 days or your own range, up to 30 days.
- You pick what they can do:
- Protected admin (the default): a full admin who can't install plugins, create other admins or touch your account.
- Custom access: tick exactly the permissions they need.
- Full admin: no limits, with an email alert on every login and a warning if they create another admin.
- Safe links: the login link opens a confirm screen first, so email and chat link scanners can't use it up.
- Your choice of limits: one-time passes, an IP address allowlist, and an email when they log in.
- See what they changed: the Activity tab lists the posts, pages, products, settings, plugins, themes and users they changed, and order status changes, with times and IP addresses. Export it as CSV.
- Stay in control: suspend, extend or end a pass at any time. The Emergency lock in the admin bar ends every pass at once.
- Your account stays private: their account can't see or edit yours, and HappyAccess is hidden from their plugin list.
- Their work stays: posts they wrote move to your account when the access ends. Nothing they made is deleted.
- For agencies and hosts: WP-CLI commands to create, list, extend and end passes from the terminal.
- They select "Email me a login code" on the login form and type their email or username.
- They get one email with a 6-digit code and a login link. Both work for 10 minutes by default (5 to 30, your choice).
- They type the code, or open the link on any device, and they're in.
- The WordPress login page (wp-login.php).
- WooCommerce My Account and the classic WooCommerce checkout, inline with no page reload.
- Any page, with the HappyAccess Login block or the
[happyaccess_login]shortcode.
- The screen gives the same answer for an email that has an account and one that doesn't, so nobody can use it to find out who has an account.
- A code only works in the browser that asked for it, with 5 tries before it's cancelled.
- Login links can only be used once, and only from the confirm screen.
- Per role, keep "Password or email code" or switch a role to "Email code only".
- Authenticator app: works with any app that supports standard time-based codes (TOTP), like Google Authenticator, Microsoft Authenticator, Authy, 1Password and Bitwarden. Setup shows a QR code, drawn on your own site.
- Email codes: a 6-digit code sent to the account's email.
- Backup codes: 10 one-time codes for when the phone isn't around.
- Optional or required per role: for example required for administrators and shop managers, optional for customers.
- A grace period for required roles: a few logins or days to set it up, then it becomes part of their next login.
- Setup where people already are: on their WordPress profile, or in WooCommerce My Account for customers.
- Never locked out: an admin can turn it off from a user's profile, you can run
wp happyaccess twostep reset <user>, or add one line to wp-config.php. - Plays nicely with others: if Two Factor, Wordfence Login Security, WP 2FA or Kadence Security already protects an account, HappyAccess skips that account, so nobody is asked twice.
- No outside services by default. Optional Google reCAPTCHA v3 is the only one, and it's off until you add your own keys.
- Hashed and encrypted: access codes, login links and email codes are stored as hashes, never in plain text. Authenticator secrets are encrypted.
- Rate limits: wrong codes are limited per IP address and per account, and the owner gets an email if a site sees a lot of wrong codes.
- Compatible: works with hidden login URL plugins like WPS Hide Login, with page cache plugins, and with security plugins.
- Multisite: network activated or per site.
- Accessible: the admin screens follow your admin color scheme and are checked with automated accessibility tests.
- Light: the login form script needs no jQuery and loads only on pages that show a HappyAccess form.
Hi! To look into this, I need to log in to your site. You don't have to send me a password or make me an account.My access ends by itself when the time is up, and you can end it earlier from the same screen. You'll also see what I changed while I was in.
- Install the free HappyAccess plugin from your Plugins screen.
- Go to Users > HappyAccess and create a pass. Three days is plenty.
- Send me the link it shows you.
安装:
- In your dashboard, go to Plugins > Add New Plugin and search for "HappyAccess".
- Install and activate it.
- Go to Users > HappyAccess. Temporary access is on from the start.
- To add passwordless login or two-step login, turn them on in the Settings tab, then set them up in Login and security.
屏幕截图:
常见问题:
How do I give someone temporary admin access to my WordPress site?
Go to Users > HappyAccess, type who it's for, pick how long it lasts and what they can do, and create the pass. Send them the login link or the 8-digit code. Their access ends by itself at the time you picked.
Can the support person see my password?
No. They log in with their own link or code, and their account is separate from yours. They never see or need your password.
What happens when temporary access ends?
Their sessions end, they're logged out, and their temporary account is removed. Anything they wrote moves to your account and is never deleted. The activity log stays for as long as you keep logs (30 days by default).
Can I end temporary access early?
Yes. End or suspend any pass from the Temporary access tab. The Emergency lock button in the admin bar ends every pass at once.
Does a support pass work on a copy of my site?
No. A pass logs them in to your live site, and what they change is real. The access level sets what they can do, and the Activity tab shows what they did. Your other plugins run as usual while they work. On Protected admin and Custom access passes, if a plugin tries to change role permissions on a page they load, outside a plugin activation or update, HappyAccess refuses the change and logs it as "Role change blocked".
Is a login link the same as a magic link?
Yes. A login link (often called a magic link) logs someone in without a password. HappyAccess login links open a confirm screen first and only work once, so a link scanner in Outlook, Gmail or Slack can't use them up before the person does.
How does passwordless login work with WooCommerce?
Turn on Passwordless login, and customers see "Email me a login code instead" under the login form on My Account and on the classic checkout. They type their email, get a 6-digit code, and log in without leaving the page. After logging in, they land back on My Account or the checkout.
Can I add the email code option to the WooCommerce block checkout?
The block checkout doesn't let plugins add to its sign-in prompt yet. Add the HappyAccess Login block to your checkout page instead. The classic checkout and My Account get the option on their own.
Why does the login shortcode show as plain text on my page?
Passwordless login is off. The [happyaccess_login] shortcode works only while it's on. Turn it back on in Settings, or take the shortcode off your pages. The HappyAccess Login block shows nothing while Passwordless login is off.
Which authenticator apps work with two-step login?
Any app that supports standard time-based one-time codes (TOTP, RFC 6238). That includes Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden and most password managers.
Can I require two-factor authentication for administrators only?
Yes. In Login and security, set each role to Off, Optional or Required. For example, Required for Administrator and Shop manager, and Optional for everyone else. Required roles get a grace period to set it up.
Do customers who sign up at checkout have to set up two-step login right away?
No. WooCommerce logs a new account in as soon as it's made, at sign-up on My Account or at checkout, without the login form. If the Customer role is Required, the setup screen and the grace period start at their next login.
Does two-step login work with custom login forms?
Yes, when the form logs people in through WordPress's own sign-in function, wp_signon(). That covers the WordPress login page, WooCommerce and any other login form built on it. A form that skips it can opt in with the happyaccess_twostep_login_request filter.
Someone is locked out of two-step login. What do I do?
Pick whichever fits:
- As an admin, open their profile and select "Turn off two-step login for this user".
- Run
wp happyaccess twostep reset <user>. - If you're locked out yourself, add
define( 'HAPPYACCESS_DISABLE_TWOSTEP', true );to wp-config.php, log in, set it up again, then remove the line.
Can I make a role log in only with an email code?
Yes, in Login and security. A password login for that role gets the same message as a wrong password, so the message never shows which accounts use email codes. If email stops working on your site, add define( 'HAPPYACCESS_ALLOW_PASSWORD_LOGIN', true ); to wp-config.php to get back in with a password.
I changed the security keys in wp-config.php. Why do people need to set up their app again?
Authenticator secrets are encrypted with your site's keys. New keys mean the old secrets can't be read, so app codes stop working. Two-step login stays on, and people can still log in with an email code or a backup code, then set up the app again from their profile.
New keys also stop current support passes. WordPress logs the support person out, and the pass's link and code stop working. Select New link and code on a pass to send working ones. Login codes and links already emailed stop working too, so people ask for a new one.
The same happens when the HappyAccess site key is lost, except WordPress doesn't log anyone out. The key is the happyaccess_secret option in the database, and a site move or a database cleanup plugin can leave it out. HappyAccess then makes a new key. Copy the whole options table when you move a site.
Why did I get a new device alert from a browser I always use?
HappyAccess knows a browser by a cookie with a random ID, and it stores that ID as a hash made with your site's keys. Clearing cookies makes the browser look new. So do new security keys in wp-config.php or a lost HappyAccess site key: every browser looks new at its next login, and each watched person gets an alert for it. Each person gets at most 3 alerts an hour, and after that login the browser is known again.
Does it work with WPS Hide Login and other hidden login URL plugins?
Yes. Every HappyAccess screen is a step of the normal WordPress login page, so a hidden login URL plugin moves it along with everything else.
Does it work with Wordfence and other security plugins?
Yes. HappyAccess codes don't count as wrong passwords, so a brute force lockout won't lock anyone out over them. If Wordfence Login Security, Two Factor, WP 2FA or Kadence Security already adds two-step login to an account, HappyAccess skips that account. One thing to know: plugins that add their own checks to the password login, like user approval or country blocks, don't run on code and link logins.
Does it work with page cache plugins?
Yes. Every HappyAccess login screen tells caches not to store it.
Does it work on WordPress multisite?
Yes, network activated or per site. When it's network activated, two-step login follows the main site's settings on every site.
Does HappyAccess slow down my site?
No. Each feature loads only when it's on, and only on the pages that need it. Your other pages get no HappyAccess script or style.
Is HappyAccess free?
Yes. There's no paid version and no account to sign up for.
Where do I report a security issue?
Please report it privately through the security policy at https://github.com/shameemreza/happyaccess/security/policy, not in the support forum.
更新日志:
- New: Passwordless login with an email code or login link, on the login page, WooCommerce My Account and checkout, a block and a shortcode.
- New: Two-step login (2FA) with an authenticator app, email codes and backup codes, optional or required per role.
- New: New device login alerts for administrators, and any other role you pick.
- New: A new admin screen with a live pass preview, the Activity tab and the Login and security tab.
- New: Protected admin, Custom access and Full admin access levels.
- New: Login links open a confirm screen, so link scanners can't use them up.
- New: The Activity tab shows what temporary users changed, with CSV export.
- New: WP-CLI commands for passes and two-step resets.
- New: Multisite support, network activated or per site.
- Security: codes and keys are stored as hashes, with rate limits per IP address and per account.
- Security: the access code is now 8 digits.
- Changed: temporary users' posts move to your account when access ends. They're never deleted.
- Changed: HappyAccess needs WordPress 6.7 or later. 1.0.6 needed 6.0.
- Your active access codes keep working on the new code screen, for up to 7 days from the upgrade.
- Login links and share links made with 1.0.x stop working at the upgrade. Send the access code instead, or make a new pass.
- There's no way back to 1.0.6 after upgrading, because the database changes.
- Fixed: code login on hosts with mod_security that strip extra fields from wp-login.php.
- New: admin menu restrictions, hide the admin bar, protection for the site owner's account and suspend or reactivate access.