Title: WebEquipe Passwordless Checkout for WooCommerce Author: WebEquipe Published: September 16, 2026 Last modified: September 16, 2026 --- Search plugins ![](https://ps.w.org/webequipe-passwordless-checkout/assets/banner-772x250.png?rev =3697971) ![](https://ps.w.org/webequipe-passwordless-checkout/assets/icon-256x256.png?rev =3697971) # WebEquipe Passwordless Checkout for WooCommerce By [WebEquipe](https://profiles.wordpress.org/webequipe/) [Download](https://downloads.wordpress.org/plugin/webequipe-passwordless-checkout.1.0.0.zip) * [Details](https://wordpress.org/plugins/webequipe-passwordless-checkout/#description) * [Reviews](https://wordpress.org/plugins/webequipe-passwordless-checkout/#reviews) * [Installation](https://wordpress.org/plugins/webequipe-passwordless-checkout/#installation) * [Development](https://wordpress.org/plugins/webequipe-passwordless-checkout/#developers) [Support](https://wordpress.org/support/plugin/webequipe-passwordless-checkout/) ## Description **Passwordless Checkout** removes the two biggest sources of checkout drop-off: forced login and duplicate customer accounts. When a guest places an order, the plugin silently detects the billing email and links the order to the matching customer account — or creates one — **without asking the customer to log in or set a password**. Later, they access their account via a single-use, expiring **magic login link** sent to their email. No external services. No tracking. All tokens are generated with a cryptographically secure random generator, stored hashed, and expire automatically. #### What it solves **Problem 1 — Checkout drop-off from forced login.** WooCommerce can require login before checkout. Customers abandon rather than remember a password. This plugin lets anyone check out as a guest while still creating (or linking to) a real customer account in the background. **Problem 2 — Duplicate customer accounts.** When the same customer checks out multiple times with different guest sessions, WooCommerce can create a new account each time. This plugin detects the email and reuses the existing account — one email, one customer, always. **Problem 3 — Password friction on My Account.** Customers who can’t remember their password hit a wall at login. This plugin replaces the WooCommerce login form with an email field + “Send Login Link” button. One click, no password. #### Key features * **Auto order linking** — guest orders linked to the matching account by billing email. * **Auto registration** — new accounts created silently; no password prompt, no credentials email. * **Duplicate prevention** — one email always maps to one customer account. * **Magic link login** — single-use, expiring links (default 30 min); rate-limited to prevent abuse. * **Guest order view** — expiring token links in order emails let guests view their order without logging in. * **Invoice / payment link access** — customers can pay custom orders without logging in (within a configurable window from order creation). * **Passwordless login UI** — choose how customers log in: passwordless only (email- only “Send Login Link” form), both (standard password form plus the login link), or password only. * **Admin merge tool** — WooCommerce Passwordless Checkout Merge Customer Accounts: find duplicates, preview, merge. * **WooCommerce Blocks support** — works with both classic shortcode and Block- based checkout. * **HPOS compatible** — fully supports High-Performance Order Storage. * **Logging** — optional, via the built-in WooCommerce logger (WooCommerce Status Logs). #### Getting started (about 2 minutes) 1. Activate the plugin (WooCommerce must already be active). 2. Open **WooCommerce Passwordless Checkout**. 3. Review the General tab (defaults are already enabled) and click **Save Changes**. 4. Optionally adjust Magic Link expiry / rate limits and the email template. 5. Place a test guest order — it should appear linked to a customer account under ** WooCommerce Orders**. 6. Open My Account while logged out and request a login link to verify email delivery. #### Privacy & security * No external requests, tracking, or data sharing — everything runs on your own server. * Tokens use `random_bytes()` (CSPRNG), are stored hashed with `wp_hash()`, are single-use, and expire automatically. * Constant-time comparison (`hash_equals()`) prevents timing attacks. * Nonces and capability checks protect every form and admin action. * Magic link requests return a neutral response to prevent account enumeration. * Optional logs mask email addresses and focus on order/user IDs. * A privacy-policy suggestion is registered under **Settings Privacy** for store owners. This plugin does **not** connect to third-party APIs. Email is sent through your WordPress / WooCommerce mail configuration (`wp_mail()`). ### Troubleshooting #### Magic login link returns 404 Go to **Settings Permalinks** and click **Save Changes** once to flush rewrite rules, then try the link again. #### Login link email never arrives 1. Confirm magic links are enabled (**Login Experience** is not set to “Password only”). 2. Check spam/junk folders. 3. Verify WordPress can send mail (use your existing SMTP / WooCommerce email setup). 4. With logging enabled, check **WooCommerce Status Logs** for send success/failure entries. #### Guest order is still not linked to a customer 1. Confirm **Auto-Link / Auto-Register** is enabled. 2. Confirm the order has a valid billing email. 3. For block checkout, confirm **Blocks Checkout Support** is enabled. 4. Review logs for resolution errors. #### “Too many login links” message Wait for the rate-limit window to expire, or raise the limits under **Magic Link** settings. #### Uninstall cleanup Deleting the plugin through the WordPress admin removes plugin options, related user meta, and related order meta. Short-lived hashed rate-limit transients expire on their own (their names cannot be listed without a direct database query). Customer accounts and orders themselves are never deleted by uninstall. ## Screenshots [⌊My Account login screen — customers enter only their email and get a secure login link; no password fields.⌉⌊My Account login screen — customers enter only their email and get a secure login link; no password fields.⌉[ My Account login screen — customers enter only their email and get a secure login link; no password fields. [⌊General settings — turn on auto-link/auto-register, enable Blocks checkout support, choose login experience mode, and toggle logging.⌉⌊General settings — turn on auto- link/auto-register, enable Blocks checkout support, choose login experience mode, and toggle logging.⌉[ General settings — turn on auto-link/auto-register, enable Blocks checkout support, choose login experience mode, and toggle logging. [⌊Magic Link settings — set login link expiry, payment-link access days, guest order- view days, and rate-limit rules.⌉⌊Magic Link settings — set login link expiry, payment- link access days, guest order-view days, and rate-limit rules.⌉[ Magic Link settings — set login link expiry, payment-link access days, guest order- view days, and rate-limit rules. [⌊Merge Customer Accounts — search two accounts by email, review details, and merge the secondary account's orders into the primary account.⌉⌊Merge Customer Accounts— search two accounts by email, review details, and merge the secondary account's orders into the primary account.⌉[ Merge Customer Accounts — search two accounts by email, review details, and merge the secondary account’s orders into the primary account. [⌊Email Template settings — customize the magic-link email subject and body using placeholders like {magic_link} and {site_name}.⌉⌊Email Template settings — customize the magic-link email subject and body using placeholders like {magic_link} and { site_name}.⌉[ Email Template settings — customize the magic-link email subject and body using placeholders like {magic_link} and {site_name}. ## Installation **From the WordPress admin:** 1. Go to **Plugins Add New**. 2. Search for “WebEquipe Passwordless Checkout”. 3. Click **Install Now**, then **Activate**. 4. Go to **WooCommerce Passwordless Checkout** and click **Save Changes**. **Manual installation:** 1. Download the plugin zip. 2. Go to **Plugins Add New Upload Plugin**. 3. Upload the zip and activate. 4. Go to **WooCommerce Passwordless Checkout** and click **Save Changes**. **Requirements:** WooCommerce must be installed and active. ## FAQ ### Does this require WooCommerce? Yes. WooCommerce must be installed and active. The plugin will not activate without it. ### Will it interfere with my existing customers or orders? No. Activating the plugin does not rewrite existing orders, customers, or settings. It acts at checkout, on My Account login, in order emails (guest order view and payment links), and via the admin merge tool. ### Are passwords ever sent to customers? Never. The plugin does not generate, display, or email passwords or credential setup links. Customers log in only via magic links (when enabled). ### Does it work with the block-based checkout? Yes. Both the classic (shortcode) checkout and the WooCommerce Blocks (Store API) checkout are fully supported. ### What happens if a customer uses a different email address? The plugin matches by billing email only. If a customer uses a different email at checkout, a new account is created for that email. You can merge accounts later using **WooCommerce Passwordless Checkout Merge Customer Accounts**. ### How long do magic links last? By default, 30 minutes. You can change this under **WooCommerce Passwordless Checkout Magic Link**. Links are single-use — clicking them a second time will show an expired message. ### What is the rate limit on magic link requests? By default, a maximum of 3 requests per 15-minute window per email address. Both values are configurable in the settings. ### Where do I find the logs? Enable logging under **WooCommerce Passwordless Checkout General**, then find entries under **WooCommerce Status Logs** with the source `webequipe-passwordless- checkout`. ### Does the guest order-view link expire? Yes. By default, the “View your order” link included in order emails expires after 7 days. After expiry, the page shows an expired message and a link to My Account. The expiry duration is configurable. ### Is it HPOS compatible? Yes. The plugin declares High-Performance Order Storage compatibility and stores order meta through the WooCommerce order APIs (HPOS-aware). ### Will this cause issues with caching plugins? Magic link URLs and order-view URLs use query parameters, which most page caching plugins bypass by default. If you experience issues, exclude URLs containing `weplc_magic_login` and `weplc_order_view` from your cache. ### How does the admin merge tool work? Go to **WooCommerce Passwordless Checkout Merge Customer Accounts**. Search two email addresses, preview both accounts (name, order count, registration date), confirm, and the plugin moves all orders from the secondary account to the primary, backfills any missing address data, and deletes the secondary user. The action requires `manage_woocommerce` capability and a nonce confirmation. ### Does this plugin use shortcodes or blocks? No shortcodes are registered. The plugin integrates with WooCommerce checkout (classic and Blocks) and the My Account login form automatically. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “WebEquipe Passwordless Checkout for WooCommerce” is open source software. The following people have contributed to this plugin. Contributors * [ WebEquipe ](https://profiles.wordpress.org/webequipe/) * [ Sarwar Hossain ](https://profiles.wordpress.org/bdsarwar/) [Translate “WebEquipe Passwordless Checkout for WooCommerce” into your language.](https://translate.wordpress.org/projects/wp-plugins/webequipe-passwordless-checkout) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/webequipe-passwordless-checkout/), check out the [SVN repository](https://plugins.svn.wordpress.org/webequipe-passwordless-checkout/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/webequipe-passwordless-checkout/) by [RSS](https://plugins.trac.wordpress.org/log/webequipe-passwordless-checkout/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.0 * Initial public release. * Email-based customer detection at checkout (case-insensitive, classic + Blocks). * Auto order linking to existing customer accounts by billing email. * Auto registration of new customers — no password shown, no credentials emailed. * Duplicate account prevention — one email always maps to one account. * WooCommerce Blocks (Store API) support via `woocommerce_store_api_checkout_order_processed`. * HPOS (High-Performance Order Storage) compatibility declared. * Passwordless magic link login — single-use, expiring tokens (default 30 min), CSPRNG + hashed storage. * Rate limiting for magic link requests — configurable per-email window and max count. * Guest order-view tokens in order emails — read-only order page, no login required. * Password-free access for custom order / invoice payment links (order key authorization, no login session). * Passwordless login UI — selectable login experience (passwordless only, both, or password only) on the My Account login form. * Customizable magic link email — subject, body, and placeholders (`{magic_link}`,`{ site_name}`, `{customer_name}`). * Admin merge accounts tool — search, preview, confirm, merge, with nonce and capability protection. * Admin tabbed settings — General / Magic Link / Merge Customer Accounts / Email Template. * Logging via the WooCommerce logger — activity log for detection, linking, registration, and magic link lifecycle. * Daily cron cleanup of expired tokens. * Full uninstall cleanup — all plugin options, user meta, and order meta removed on uninstall. ## Meta * Version **1.0.0** * Last updated **6 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.2 or higher ** * Tested up to **7.1** * PHP version ** 7.4 or higher ** * Tags * [checkout](https://wordpress.org/plugins/tags/checkout/)[guest checkout](https://wordpress.org/plugins/tags/guest-checkout/) [magic link](https://wordpress.org/plugins/tags/magic-link/)[passwordless](https://wordpress.org/plugins/tags/passwordless/) [woocommerce](https://wordpress.org/plugins/tags/woocommerce/) * [Advanced View](https://wordpress.org/plugins/webequipe-passwordless-checkout/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/webequipe-passwordless-checkout/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/webequipe-passwordless-checkout/reviews/) ## Contributors * [ WebEquipe ](https://profiles.wordpress.org/webequipe/) * [ Sarwar Hossain ](https://profiles.wordpress.org/bdsarwar/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/webequipe-passwordless-checkout/)