Skip to main content

benecaster_signed_link_logged_in

Action Free

Fires after a subscriber has been signed in by clicking an emailed link rather than by entering a password.

It fires in addition to WordPress’s own wp_login, not instead of it. Benecaster deliberately fires wp_login too, so security logs, last-seen timestamps and MFA integrations all see a real login — skipping it would make this a login half the site never learns about. But wp_login cannot tell a passwordless arrival from an ordinary one, and this hook can. A listener hooked to both runs twice for one arrival; pick one.

The elevated-account guard is a feature, not an edge case. An account that can edit_posts is never signed in by an emailed link, so this hook never fires for one — those accounts get the WordPress password-reset screen instead. An emailed link is a bearer credential: whoever opens a forwarded message is who gets in, which is an acceptable trade for a follower reaching their own feed URL and not acceptable for wp-admin. The reset path also leaves evidence, because setting a password invalidates the old one, where a silent auto-login leaves none. There is deliberately no filter to lift this, and a podcaster testing their own follow form from an admin address will hit it and may conclude the feature is broken.

Parameters

Name Type Default Description
$user_id int — The subscriber who was signed in.
$purpose string — One of the `SignedLink::PURPOSE_*` constants.

Examples

Nudge passwordless arrivals to set a password, once

add_action( 'benecaster_signed_link_logged_in', function ( int $user_id, string $purpose ): void {
    if ( get_user_meta( $user_id, '_my_addon_password_nudged', true ) ) {
        return;
    }

    update_user_meta( $user_id, '_my_addon_password_nudged', 1 );
    set_transient( 'my_addon_nudge_' . $user_id, 1, HOUR_IN_SECONDS );
}, 10, 2 );

Notes

Do not use this hook to perform anything the arriving visitor did not ask for. Logging someone in from a GET request is a login CSRF by construction — that is inherent to every magic link, not a defect here — so an attacker can cause this hook to fire for a victim's browser. Recording a flag or showing a notice is fine. Charging something, sending mail, or deleting anything is not.

Any existing session is cleared first. Someone may already be signed in as a different user — a shared machine at home is the ordinary case — and the link is proof of mailbox ownership for the account it names, so switching is correct.

Related Recipes

Need this built rather than just documented? See our services →