Signing in to any site’s wp-admin with one click

You can open the WordPress admin of any connected site from WP Safer without typing a password. It is one button, and there is no shared password behind it — the site is asked to open a session, and it decides whether to.

Where the button is

• Sites list — the Login button at the right end of each row.
• Site details — the small icon with the key in the header, next to Open and Sync.

Both open the site's /wp-admin in a new tab. Both are disabled while a site is paused or not answering: there is nothing to sign in to until the connection works again.

What happens when you click

The button is a form that posts from your browser straight to the site — not from our servers. It carries a signature built from the moment you loaded the page and the site's own access key, and the key itself is never sent. The connector plugin checks the signature, opens a session for an administrator account, and redirects you to the dashboard.

WordPress's normal login hook is fired on the way, deliberately, so plugins that record last-login times or send login notifications behave exactly as they would after a login through the login form.

Which account you land in

The site picks an account that actually has administrator capabilities, and refuses if it cannot find one. It does not fall back to "user number 1" or to whatever name it was handed — a login name on its own is not a permission.

This is also the plain answer to "does WP Safer store my WordPress password": no. There is no password to store. What exists is the site key, and that key is worth an administrator password precisely because of this feature — see How WP Safer reaches your site.

When the button does not get you in

• The page has been open for a while. The signature is built when the page is rendered and the site refuses one that is more than five minutes old. Reload the Sites page and click again.
• You land on the login form instead of the dashboard. This is almost always an address mismatch — the site answers on www.example.com but is registered as example.com, or the other way round. The session cookie is written for the address the request went to, and the redirect goes to the site's own canonical address, so the browser never sends it back. WP Safer builds the request from the address the site itself reports, so running Check again on the Details tab usually fixes it; if the site's own WordPress address setting is wrong, it has to be corrected there.
• The connector plugin is inactive or missing. The row says No plugin found; nothing works until it is back.
• A security plugin or firewall on the site blocks it. The login request arrives from your own address rather than from our servers, which is why it is the one request the connector accepts from anywhere. Something on the site that filters admin logins can still stop it.

Who can use it

Only people signed in to your WP Safer account, and only for the sites in that account. The button is rendered per row with a signature for that one site; there is no shared link you can copy and send to someone else that keeps working — the signature is only accepted for five minutes.

If you want to take the ability away from WP Safer entirely, change the site key in the site's own WP Safer plugin settings, or remove the plugin. Both end the access immediately.