EmailLink

• 

  5fleenors · Member · Sep 3, 2018 at 3:40 pm

  • Copy link
  • Add topic to favorites

  Received notification someone logged into my account with an email link. What exactly does this mean?

• 

  torres126 · Member · Sep 3, 2018 at 9:15 pm

  • Copy link

  Hi there,

  An email login link is used to (frustratingly) bypass 2FA and a password to enter your WordPress.com account by being able to log in just by clicking a link in your email.

  If you believe that somebody has compromised your account or you are at risk of your account being compromised, changing your password to ensure it is a strong one is the best thing to do: https://en.support.wordpress.com/selecting-a-strong-password/

  I’d also suggest highly recommend using 2 Step Verification: https://en.support.wordpress.com/security/two-step-authentication/

  Consider disabling or changing your Post by Email address, but most importantly, ensure that nobody knows it: https://en.support.wordpress.com/post-by-email/

  Also, ensure you turn on two step authentication on your email – I can’t stress enough how important that can be, regardless of what other services you use. If you need help with doing that, let us know your email provider and we’ll try to assist.

  This will help keep your account very secure, but for this issue, I’m tagging WordPress.com staff to check for suspicious activity.

  Let us know if you have any further questions or issues. :)

• 

  brookedot · Member · Sep 3, 2018 at 10:25 pm

  • Copy link

  Hi there,

  I don’t see any suspicious activity on your account. I do see several logins using the magic link being sent to the email on your account. Do you remember clicking a link sent to your address to log into WordPress.com?

• 

  supernovia · Staff · Sep 3, 2018 at 10:26 pm

  • Copy link

  Thanks for flagging us, @torres126. If I understand properly, this option is not available if you have 2FA enabled.

  
  @5fleenors did you have a link emailed to yourself so you could use that rather than typing a password?

• 

  torres126 · Member · Sep 4, 2018 at 5:56 am

  • Copy link

  @supernovia Hmm…I just tried using one and although it bypassed my password, I had to enter a verification code too. That’s good to hear! I sent an email about this a few days ago and I could swear that wasn’t the case previously. I’m still hoping for the day where it requires personal information to request an email login link or password reset (not just a username), or potentially even an option to disable email login links completely.