Readers have no password. They type their address, get a link, and open it.
That is Ghost’s model and it is the right one for a publication: a password is a thing to forget, to reuse, and to have stolen, and the address is the only part of a reader’s identity a newsletter actually needs to be sure of.
Staff still sign in with a password at wp-admin exactly as before. The passwordless flow is for everyone who is not staff.
Signing in
- The reader puts their address into the Sign in / Sign up block on your sign-in page.
- They get an email with a link.
- They open it, land on your site, and are signed in.
The link is good for 24 hours, and for a few uses within ten minutes of the first — enough for the mail clients that visit links before the human does, and not enough to be a standing key. A link that is too old says so plainly and offers a fresh one.
Sessions last about six months, so a reader who signs in on their phone stays signed in.
Signing up free
The account is created when the link is opened, never before. The only claim a free sign-up makes is this is my address, and an email is the one instrument that tests it. Nothing exists until the reader proves the inbox is theirs.
form -> link in the inbox -> account created, signed in
Signing up paid
A purchase is different, and it is different in a way worth knowing about:
form -> free account created -> Stripe Checkout -> paid
-> sign-in link mailed
The reader goes straight from the button to Stripe, in the same click. An inbox in the middle of a purchase is a place to lose people — they leave to find a message, three minutes pass, and the thing they came to do is somebody else’s problem now.
Paying is not signing in, though. A card is not proof of an inbox, and if paying were a way into an account then five dollars would be a way into somebody else’s. So when the money lands, the reader is emailed an ordinary sign-in link and gets in by opening their own email like everybody else. The inbox did not disappear from the paid flow — it moved to after the payment, where it costs nobody a sale.
Two useful consequences:
- An abandoned checkout leaves a free member rather than nothing at all, so you can still email them.
- A reader who never opens that link is still a paying member with access; they simply have not signed in on that device yet.
Signing out
Readers sign out through a link on their account page, not at wp-login.php. The theme’s member nav carries one too.
Changing an address
A reader changes their address on their Account page, and nothing is written until they open a confirmation link sent to the new address.
This is not ceremony. Sign-in is passwordless, so the address is the credential: a typo saved straight into the database locks a reader out of their own account for good, with the only way back going to an address nobody reads.
Staff changing an address from the Members screen skips that step — see one reader, up close.
Who may sign up at all
OwlDraft → Membership → Access decides: anyone, invite-only (which ships later and behaves as closed for now), or closed. Closing sign-ups leaves existing members untouched; it only stops new ones.
Rate limits
Requests for links are capped per address and per IP over a rolling twelve hours — eight and thirty respectively. A reader who mistypes their address four times is unaffected; somebody pumping your sign-in form is not.
Every limit is a constant you can raise in wp-config.php; see constants and hooks.
When a reader says they never got the link
Open them on the Members screen and read the activity feed. It says whether the message was sent, delivered, opened or bounced. See bounces, unsubscribes and the mail log.
Next: the blocks.