WebEquipe Passwordless Checkout for WooCommerce

Passwordless Checkout removes the two biggest sources of checkout drop-off: forced login and duplicate customer accounts.

When a guest places an order, the plugin silently detects the billing email and links the order to the matching customer account — or creates one — without asking the customer to log in or set a password. Later, they access their account via a single-use, expiring magic login link sent to their email.

No external services. No tracking. All tokens are generated with a cryptographically secure random generator, stored hashed, and expire automatically.

What it solves

Problem 1 — Checkout drop-off from forced login.
WooCommerce can require login before checkout. Customers abandon rather than remember a password. This plugin lets anyone check out as a guest while still creating (or linking to) a real customer account in the background.

Problem 2 — Duplicate customer accounts.
When the same customer checks out multiple times with different guest sessions, WooCommerce can create a new account each time. This plugin detects the email and reuses the existing account — one email, one customer, always.

Problem 3 — Password friction on My Account.
Customers who can’t remember their password hit a wall at login. This plugin replaces the WooCommerce login form with an email field + “Send Login Link” button. One click, no password.

Key features

• Auto order linking — guest orders linked to the matching account by billing email.
• Auto registration — new accounts created silently; no password prompt, no credentials email.
• Duplicate prevention — one email always maps to one customer account.
• Magic link login — single-use, expiring links (default 30 min); rate-limited to prevent abuse.
• Guest order view — expiring token links in order emails let guests view their order without logging in.
• Invoice / payment link access — customers can pay custom orders without logging in (within a configurable window from order creation).
• Passwordless login UI — choose how customers log in: passwordless only (email-only “Send Login Link” form), both (standard password form plus the login link), or password only.
• Admin merge tool — WooCommerce → Passwordless Checkout → Merge Customer Accounts: find duplicates, preview, merge.
• WooCommerce Blocks support — works with both classic shortcode and Block-based checkout.
• HPOS compatible — fully supports High-Performance Order Storage.
• Logging — optional, via the built-in WooCommerce logger (WooCommerce → Status → Logs).

Getting started (about 2 minutes)

1. Activate the plugin (WooCommerce must already be active).
2. Open WooCommerce → Passwordless Checkout.
3. Review the General tab (defaults are already enabled) and click Save Changes.
4. Optionally adjust Magic Link expiry / rate limits and the email template.
5. Place a test guest order — it should appear linked to a customer account under WooCommerce → Orders.
6. Open My Account while logged out and request a login link to verify email delivery.

Privacy & security

• No external requests, tracking, or data sharing — everything runs on your own server.
• Tokens use random_bytes() (CSPRNG), are stored hashed with wp_hash(), are single-use, and expire automatically.
• Constant-time comparison (hash_equals()) prevents timing attacks.
• Nonces and capability checks protect every form and admin action.
• Magic link requests return a neutral response to prevent account enumeration.
• Optional logs mask email addresses and focus on order/user IDs.
• A privacy-policy suggestion is registered under Settings → Privacy for store owners.

This plugin does not connect to third-party APIs. Email is sent through your WordPress / WooCommerce mail configuration (wp_mail()).

Troubleshooting

Magic login link returns 404

Go to Settings → Permalinks and click Save Changes once to flush rewrite rules, then try the link again.

Login link email never arrives

1. Confirm magic links are enabled (Login Experience is not set to “Password only”).
2. Check spam/junk folders.
3. Verify WordPress can send mail (use your existing SMTP / WooCommerce email setup).
4. With logging enabled, check WooCommerce → Status → Logs for send success/failure entries.

Guest order is still not linked to a customer

1. Confirm Auto-Link / Auto-Register is enabled.
2. Confirm the order has a valid billing email.
3. For block checkout, confirm Blocks Checkout Support is enabled.
4. Review logs for resolution errors.

“Too many login links” message

Wait for the rate-limit window to expire, or raise the limits under Magic Link settings.

Uninstall cleanup

Deleting the plugin through the WordPress admin removes plugin options, related user meta, and related order meta. Short-lived hashed rate-limit transients expire on their own (their names cannot be listed without a direct database query). Customer accounts and orders themselves are never deleted by uninstall.