It could be better to say Invalid magic login token, try to create <a href="%s">a new login link</a>? instead Invalid magic login token. <a href="%s">Try signing in instead</a>? when forcing magic login as the default login method.

Users can create several access requests. Each URL has a different token BUT they all work.
Ideally, when a new access request is made using the same email address, the previous token should be invalidated, ensuring that only the most recent token remains active. This would prevent unauthorized access through previously generated links.

title explains all

The default login button seems to be a secondary action when having magic login enabled. Add the default login button in the same way we inject "Send me the login link"

It might be useful to save logs through steam

Is this desired?

Shouldn't it be the other way around, only add line breaks when there is no HTML markup in the mail?

Otherwise, each line break in the markup adds a visual line break, which adds a lot of empty space into the email and the layout breaks.

Having a passwordless login button to the standard wp-login.php page might be useful 🤔

Make it compatible with - https://wordpress.org/plugins/theme-my-login/

Users should know alternative options to embed the login forms.

https://handyplugins.co/magic-login-pro/docs/shortcode/

When using parameters/placeholders in translations strings it would be best that using translation comments to convey the context to the translators.

For example;

Login link will expire in %1$s %2$s.

As a translator, I can guess what are these parameters but I can't be sure. If they are definitive date values or relative values, or one of them maybe a number and the other one maybe the unit.

Using a comment just above the code helps translators when they see it on GlotPress (and even some other software like PoEdit that supports this convention)

/* translators: 1: TTL value (number) 2: Unit (minute(s), hour(s), days(s)) */  
$login_message .= sprintf( __( 'Login link will expire in %1$s %2$s.', 'magic-login' ), $token_ttl, $selected_interval_str );

Thanks in advance,
Cheers

Ideally, the login form could be placed anywhere on the site. A shortcode would be handy to achieve this.

Redirections like &redirect_to=https:// causes the match with 7G firewall rule

	"~*((boot|win)((\.|%2e)ini)|etc(/|%2f)passwd|self(/|%2f)environ)" 16;

It's better to encode URLs.

See: https://wordpress.org/support/topic/login-link-in-mail-has-to-many-parameters-does-not-work-with-7g-firewall/

eg:

rely on not rely on WordPress cron, that's all

It's popular the usage of "wp_login" hook by 3rd party plugins. We should fire this on the login process.

It's a weird case, but when a page has more than one magic login form, it sends multiple emails simultaneously. This should be avoided.

Add a new shortcode attribution to display the magic login form in logged-in users. This could be useful when adding the shortcode with page builders for preview

Shortcode is ok, but a customizable login form would be better

Ajaxify process for better UX

There is at least one instance that there is a string scattered to pieces instead of using placeholders for variables. Every language has it's own structure and partial strings like this are very hard to translate and sometimes even impossible.

The strings loses the context, the overall meaning of the translation gets hideous. Even if a translator checks the code and tries to construct a good translation, when those string parts are used in other areas of the code, it'll create more conflicts.

This is the part that I'm referencing:

<?php esc_html_e( 'Block the IP address for', 'magic-login' ); ?>
<input
    id="brute_force_bantime"
    name="brute_force_bantime"
    min="1"
    max="1440"
    type="number"
    class="sui-form-control sui-field-has-suffix"
    value="<?php echo absint( $settings['brute_force_bantime'] ); ?>"
>
<?php esc_html_e( 'minutes when it fails to login ', 'magic-login' ); ?>
<input
    id="brute_force_login_attempt"
    name="brute_force_login_attempt"
    min="1"
    max="100"
    type="number"
    class="sui-form-control sui-field-has-suffix"
    value="<?php echo absint( $settings['brute_force_login_attempt'] ); ?>"
>
<?php esc_html_e( 'times in', 'magic-login' ); ?>
<input
    id="brute_force_login_time"
    name="brute_force_login_time"
    min="1"
    max="600"
    type="number"
    class="sui-form-control sui-field-has-suffix"
    value="<?php echo absint( $settings['brute_force_login_time'] ); ?>"
>
<?php esc_html_e( 'minutes.', 'magic-login' ); ?>

The string should be like this;

/* translators: 1: Ban duration input 2: Trial count input 3: Interval input */
printf( __( 'Block the IP address for %1$s minutes when it fails to login %2$s times in %3$s minutes.', 'magic-login' ),
  $brute_force_bantime_input,
  $brute_force_login_attempt_input,
  $brute_force_login_time_input
); // WPCS: XSS ok.

And of course you have to fill those variables. :)

For example, if you construct the string the way I propose then it's translation would be like this;

%3$s dakika içinde %2$s kere başarısız giriş olursa IP adresini %1$s dakika engelle.

As you can see, the placeholders are all reversed because of the language structure.

At the end, it's best to avoid this kind of strings and use placeholders (and of course translator comments) as much as possible.

Cheers

Reported here: https://wordpress.org/support/topic/issue-with-slash-in-subject-email/