I'm building a plugin which receives quote data form a third party api and uses it generate a post of type 'quote' which, on the front end, comprises an acf_form which the customer is required to fill out. As soon as the post is created (upon receiving the quote data), an email is sent to the user asking them to click on the link to visit the form and fill it out.

Naturally, I don't want any of this to be public so my quotes are completely hidden from view. I had built a method using wp_nonce_url to build the link that appears in the email, validating that nonce on page load. However, I realise now that the nonce is session specific and so always fails validation the first time the link is clicked. When validation fails the user is prompted to 'request a new link' which is immediately emailed to them and which subsequently works since they already began their session.

Enough background... the above method is no good because of the necessity to request the link every (first) time. So I'm looking to come up with a new solution. Crucially, I don't want to create user accounts for these customers (that would be too easy!), I just want some form of 'magic link' which I can validate on page load, ideally with an expiration (though not essential).

One option I'm considering is sending a link with the customer's hashed email address as a $_GET parameter which I could cross reference with the email address attached to the quote. This would 'look' secure and will be unique to the customer but could easily be figured out and can't be invalidated after a certain time.

Can anyone suggest a method for this kind of thing? Thanks for reading.

  • is the only purpose of the email and link to verify their email address? It sounds like a lot of engineering to deliver the user to the next page of a quote process. Wouldn't it be easier to load the next page immediately and ask for a code that was sent in an email? Usually magic links are there to let users login without using a user/password so accounts are still involved, e.g. logging into a slack account
    – Tom J Nowell
    Commented Jun 24, 2022 at 13:55
  • Yes, @Tom J Nowell – that would work but I'd prefer them to not have to copy and paste a code. Besides which, that code would need to be stored in the database in order to be validate and, if I'm doing that, then it might as well be passed a $_GET param in the 'magic' link. Commented Jun 24, 2022 at 15:13
  • To clarify the process: the user accepts the quote off-site, then are invited to continue the process on this site. Therefore bouncing them directly to the next page in the process isn't an option. Commented Jun 24, 2022 at 15:14

1 Answer 1


I believe you are on track; add a parameter to the URL that you can test on page-load.

You could create a GUID and add a table to the database where you store the email address and the GUID; this will make guessing parameters almost impossible. You could also add a timestamp to the table in the database, which you can use to see if the link should still be valid.

Table cells: email, GUID, timestamp

  • Yes, I think that's where I'm headed with this now, @Benjamin Karlog, thanks. Essentially creating my own nonce system which is stored in the database as oppose to the session (as wp nonces are). Commented Jun 24, 2022 at 15:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.