WordPress magic login: how agents get into wp-admin without passwords

WordPress magic login is a way to open wp-admin without typing or storing a password: the platform mints a single-use, short-lived link, you (or an agent) follow it once, and it can’t be reused. ReDock is a free native macOS app that builds this into its MCP surface — an agent driving your local sites can request a login link and hand it to you, and no credentials are ever stored, pasted, or logged. Here’s how it works and why it matters for agent workflows.

The password problem for agents

The obvious way to let software log into WordPress is to give it a username and password, or an application password. That works, but it means a secret sits somewhere: in a config file, an environment variable, or an agent’s memory. Secrets that sit around get leaked, committed to git, or reused across sites. And a long-lived credential is exactly what you don’t want an autonomous agent holding.

Magic login removes the standing secret. There’s nothing to store because the link is generated on demand and dies after one use.

How the single-use link works

When the agent requests access to wp-admin, ReDock generates a one-time token tied to that request. The token is stored as a single-use transient with a short expiry. Following the link consumes the token, logs the session in, and invalidates it. Try the same link twice and the second attempt fails.

A few properties follow from that design:

No stored password. The site’s admin password is never read, never transmitted, never needed.
One use. A link that leaks after you’ve used it is already dead.
Short life. Even an unused link expires quickly, so a stale link in a chat log isn’t a standing risk.
Fresh every time. Each request mints a new token; there’s no shared secret to rotate.

Because ReDock provisions and hosts the sites itself, the login flow is part of the platform rather than a plugin you install per site. There was no HMAC secret to reuse, so the transient-backed single-use token is the whole mechanism.

What driving it looks like

You tell Claude Desktop: “Set up the new blog and give me a way in.” The agent creates the WordPress site, writes the first pages using the theme’s block patterns, and finishes by requesting a magic login link. It hands you a URL. You click it and land in wp-admin already authenticated — no password prompt. When you’re done, the link is spent; it won’t let anyone else in.

From the agent’s side this is one tool call among many. It never sees your password because there’s nothing to see. From your side it’s a single click that saves you from digging up credentials for a site you spun up two minutes ago.

Magic login is one piece of ReDock’s WordPress-on-MCP surface — the same endpoint that logs you in also creates the site, authors content, and manages plugins. For the full picture start with WordPress MCP: let Claude build, edit, and manage WordPress for you. The authoring side is covered in AI edits your WordPress site: patterns-first authoring explained and Gutenberg MCP: how an AI writes real block content. If MCP itself is new to you, read What is MCP?. The tool reference lives in the MCP docs.

FAQ

Is a magic link less secure than a password?

For this use it’s more secure. A password is a standing secret that can leak and keep working; a single-use link is dead after one click and expires on its own. Nothing durable is stored, so there’s nothing durable to steal.

What if the link leaks after I use it?

A used link is already invalid — following it a second time fails. An unused link that leaks still expires shortly on its own, so the exposure window is small either way.

Does this work on sites I didn’t create in ReDock?

Magic login is part of how ReDock provisions and hosts sites. Sites created and run through ReDock get it from first boot; the mechanism is built into the platform, not added per site.

If you want agents that can open wp-admin without ever holding a password, download ReDock — one download and a five-minute install.