HappyAccess: free temporary admin access for WordPress

You need admin access to a customer’s site. So you ask them to create a temporary user, set a password, send it to you through a one-time secret link, and delete the account when you’re done.

I was doing this multiple times a day. Some customers handled it fine. Others stopped responding because the ask felt too heavy.

First-timers found it intimidating. Tickets would stall for days over a login.

The steps weren’t broken, and the security wasn’t the issue. It was the friction. Both sides felt it.

The first version

I tried a few existing plugins. Some were close. None of them felt built for this kind of support flow. Most give you a login URL and call it done, and I needed more control than that.

So in April I built my own and called it HappyAccess. The first version was small. The site owner made a 6-digit code and picked how long it lasted. WordPress created a temporary user for that code, and when the time ran out, the user was cleaned up.

It did the job. No passwords changed hands, and no admin accounts were left behind.

Six months later, I rebuilt it

Version 1.1.0 is a rewrite. It was also the first time I built a plugin admin in React. Every setting now lives on one screen with tabs, and I went through every flow on test sites until it felt simple.

Giving someone access looks like this now.

You type who it’s for, pick what they can do and how long it lasts, and create a pass. Then you get a login link and an 8-digit code to send them.

The link opens a confirm screen first. Email and chat apps often open links to scan them, so a one-time link without that screen could get used up before the person even clicks it.

There are three access levels. Protected admin is the default: a full admin who can’t install plugins, create other admins, or touch your account. Custom access lets you pick permissions one by one. Full admin is for people you fully trust, like your host or your developer.

While they’re in, the Activity tab shows what they changed. When the time is up, their sessions end and their temporary account is removed. Anything they wrote moves to your account, so nothing is lost. And if something ever feels wrong before then, Emergency lock ends every pass at once.

Two more jobs

Version 1.1.0 also takes on two other login problems. Each one has its own switch, and a feature you leave off adds nothing to your site.

Passwordless login lets people log in with a code or link sent to their email. It works on the WordPress login page, and on WooCommerce My Account and checkout. You decide which roles can use it, so you can keep passwords for your staff.

Two-step login asks for a second step after the password: a code from an authenticator app, a code by email, or one of 10 backup codes. You can make it required for some roles, like administrators, and optional for everyone else. It also sends new device alerts, so an admin gets an email when their account logs in from a browser it hasn’t seen before.

See it before you install it

I made a short video that walks through all three.

It’s also on YouTube if you’d rather watch it there.

You can also try it without installing anything. The plugin page on WordPress.org has a Live Preview button. It opens WordPress Playground, a full WordPress site that runs right in your browser, with HappyAccess already installed.

If you’d rather see every way to do this, with or without a plugin, I wrote a guide on how to give temporary admin access to WordPress without a password.

It’s still free, and the code is on GitHub, where I run the project like a product team. Nothing leaves your site unless you turn on reCAPTCHA.

If you support WordPress sites, or you’re the one who keeps getting asked for a login, give it a try. And if something breaks or feels missing, tell me in the support forum. I’ll fix it.