內容簡介
TempAccessly 是一款專為 WordPress 管理員設計的外掛，能夠創建專屬的臨時使用者帳號並生成安全的登入網址。該帳號會根據設定的到期時間自動控制，並可隨時撤銷、延長或生成新的登入連結。
【主要功能】
• 創建專屬臨時 WordPress 帳號，不影響永久使用者
• 無密碼、令牌保護的登入網址，自動過期
• 支援角色選擇，需明確確認管理員權限
• 時間預設從 15 分鐘到 7 天，受限於最大設定
• 實時檢查，阻止過期、撤銷、禁用或孤立的臨時帳號
• 自動清理臨時帳號及舊的訪問記錄
外掛標籤
開發者團隊
② 後台搜尋「TempAccessly – Temporary Admin Access」→ 直接安裝（推薦）
原文外掛簡介
TempAccessly lets a site administrator create a dedicated temporary WordPress user and generate a secure login URL. The account is automatically controlled by the configured expiration time and can be revoked, extended, or given a newly generated login link at any time.
The login token is a 256-bit random value. Only a salted SHA-256 token hash is stored in the access table; the raw token is shown once to the administrator and is not stored in the plugin database or audit log.
The plugin adds these pages under Users:
TempAccessly – Temporary Admin Access — create and manage temporary access records.
TempAccessly Settings — configure default role, duration, maximum duration, and account cleanup.
TempAccessly Audit Logs — review access lifecycle events.
Key Features
Dedicated temporary WordPress accounts that do not modify permanent users.
Passwordless, token-protected login URLs with automatic expiration.
Role selection with an explicit confirmation requirement for Administrator access.
Duration presets from 15 minutes through 7 days, limited by the configured maximum.
Real-time checks that block expired, revoked, disabled, or orphaned temporary accounts.
Immediate revoke, active-session termination, token regeneration, and controlled extension.
Automatic cleanup of temporary accounts and old access records.
Audit logging for creation, login success/failure, extension, regeneration, revocation, expiration, and deletion.
WordPress personal-data export and erasure integration.
Security
TempAccessly uses:
Cryptographically secure 256-bit random tokens.
Salted SHA-256 token hashes instead of storing raw login tokens.
WordPress nonces for state-changing admin and AJAX requests.
manage_options capability checks for plugin administration.
Server-side allow-list validation for roles, durations, access IDs, and administrator confirmation.
Sanitization on request data and escaping on admin output.
Prepared SQL statements for variable database values and allow-listed SQL identifiers.
Immediate session destruction and authentication blocking for revoked, expired, and disabled accounts.
Strict safeguards before a temporary user can be deleted or disabled, including a plugin-owned user marker, username prefix, and protection for user ID 1.
Important: A login URL is a bearer credential. Anyone who has an active URL can use the linked temporary account. Share URLs only with the intended recipient through a secure channel. Regenerating or revoking access invalidates the previous URL.
How It Works
Go to Users > TempAccessly – Temporary Admin Access.
Click + Create Temporary Access.
Enter the recipient name, optional email, role, duration, and optional notes.
Confirm the warning when assigning the Administrator role.
Copy the generated login URL and share it securely.
Manage the record with Extend, Regenerate, Revoke, or Delete.
JavaScript is used for the normal creation interface. A server-side form handler remains available for the creation, revoke, and delete operations.
Privacy
TempAccessly processes data required to create, authenticate, manage, expire, and audit temporary access.
Data stored
Depending on the fields used and activity recorded, the plugin may store:
Recipient name and optional recipient email address.
Optional purpose or notes.
Temporary WordPress username and user ID, assigned role, creator user ID, status, and lifecycle timestamps.
Audit actions and timestamps.
IP address and browser user-agent for audit events when provided by the web server.
Temporary-user session data managed by WordPress while the recipient is signed in.
Raw login tokens and passwords are not stored in the plugin access records or audit logs.
Why is the data used?
The data is used to provision temporary users, validate login links, enforce expiration and revocation, terminate temporary sessions, display access records, and provide an audit trail.
Who can access the data?
Plugin administration and access records are available only to users with the manage_options capability.
Data sharing
The plugin does not transmit this data to external services, APIs, or third parties.
Retention
Active records remain while access is active.
Expired and revoked access records are eligible for removal after 30 days through the scheduled cleanup task.
Temporary accounts are deleted by default after expiration or revocation; when automatic deletion is disabled, they are retained in a disabled state.
Related audit events are removed when the corresponding access record is removed by retention cleanup or personal-data erasure. A manual access deletion may record a final deletion event before retention removes it.
Export and erasure
TempAccessly registers with Tools > Export Personal Data and Tools > Erase Personal Data. Matching access records are located by recipient email address. Export includes the matching access information and related audit events. Erasure removes matching temporary accounts, access records, and associated audit events where the data is available.
Uninstallation
When uninstalled through WordPress, TempAccessly removes plugin-created temporary accounts, both plugin tables, plugin options, and the scheduled cleanup hook.
