Temporary WordPress Logins That Self-Destruct
Eliminate permanent password sharing and forgotten administrator accounts. Manage time-limited access and login thresholds in the Free core, or generate one-click passwordless Magic Links with Ephemere PRO.
Built For Agencies. Hardened For Mission-Critical Sites.
Stop leaving forgotten administrator accounts on production servers. Ephemere introduces strict temporal boundaries, login thresholds, and instant session invalidation to WordPress authentication.
Precise Expiration Schedule (Date & Time)
Set exact expiration dates and times synchronized with your WordPress site timezone. Once reached, access is denied immediately and any active browsing session is terminated in real time.
- WordPress site timezone synchronization
- Real-time active session invalidation
- Automatic account lockout on expiry
Login Limits & Instant Account Lockout
Define a maximum login limit (e.g. 3 logins). As soon as the contractor exhausts their quota, the account locks out automatically. Includes a manual one-click instant lock switch without changing passwords.
- Maximum allowed logins threshold
- One-click instant lockout switch
- Read-only login counter with reset
Zero Database Bloat (Native Core)
Zero custom MySQL tables created. Ephemere operates entirely through native WordPress User Metadata (wp_usermeta) and wp_options, leaving zero orphaned records upon uninstallation.
- Zero custom database tables
- Native wp_usermeta architecture
- 100% clean uninstall via uninstall.php
Invest In Your Clients' Security.
Transparent pricing and automated invoicing. Licenses compatible with Lemon Squeezy, Freemius, or Merchant of Record with EU VAT validation.
Single Site
Ideal for freelancers or proprietary high-security projects.
- 1 Active WordPress installation
- Passwordless Magic Login Links
- GDPR-compliant Audit Trail (Last 10 Logins)
- Security Email & Webhook Alerts
- Multi-site fleet management
14-day money-back guarantee
Agency Fleet
Designed for web agencies, software houses, and DevOps teams managing dozens of clients.
- Up to 25 Active WordPress sites
- Unlimited passwordless Magic Links
- GDPR-compliant Access Audit Trail
- Webhook integration (Slack / Discord / Zapier)
- 24h Priority SLA Technical Support
Automated B2B invoicing with EU VAT
Agency Lifetime
Zero recurring subscriptions. Permanent access for large agency portfolios.
- Unlimited Sites (Unlimited Fleet)
- All future updates included for life
- Direct Core Developer Support
No renewal fees. Secure SSL payment.
Frequently Asked Questions on Security & Architecture
Everything developers, DevOps engineers, and security compliance officers need to know about RGBmind Ephemere.
How does Ephemere manage authentication without storing plaintext passwords?
Ephemere never stores plaintext credentials. In the Free version, temporary accounts rely on WordPress core's native cryptographic password hashing while enforcing time and login limits. In the PRO version, One-Click Magic Links use single-use 36-character cryptographic tokens hashed via SHA-256 and verified using constant-time comparison (hash_equals) to prevent timing attacks.
Does the plugin create custom database tables or cause database bloat?
No. Ephemere is engineered around the Zero Database Bloat principle. All temporary restrictions, login counters, and audit records are stored exclusively using native WordPress User Metadata (wp_usermeta) and wp_options. No custom tables are ever created, ensuring 100% compatibility with standard backups and hosting environments.
Is Ephemere compatible with caching plugins like WP Rocket, LiteSpeed, or Cloudflare?
100% yes. Ephemere intercepts the WordPress login endpoint (wp-login.php and init hooks) which are standardly excluded from full-page caching across edge CDNs (Cloudflare, Fastly), server caches (LiteSpeed, Varnish, Nginx FastCGI), and WordPress caching plugins. Authentication requests and session invalidations are never cached.
How does the audit log comply with GDPR and European privacy regulations?
In the PRO version, the Access Audit Log records the last 10 logins directly in the user profile and applies irreversible cryptographic IP anonymization via WordPress's native wp_privacy_anonymize_ip (zeroing out the last octet for IPv4 and the last 80 bits for IPv6), adhering strictly to European GDPR directives (Regulation EU 2016/679).
What happens to active sessions when an account expires or is revoked?
Unlike other plugins that merely prevent new logins while leaving existing sessions active, Ephemere hooks into WordPress's init cycle. When a temporary user's expiration date passes or an administrator locks the account, their active session is invalidated immediately on the server: session tokens and auth cookies are destroyed and the user is redirected to the login screen on their very next request.
If I uninstall the plugin, are there orphaned files or leftover database entries?
Zero residual data. Ephemere includes a strict VIP-standard uninstall.php script. Upon plugin deletion from the WordPress admin, all _rgbmind_* user metadata entries and plugin options are completely erased from wp_usermeta and wp_options. The database returns to the exact state it was in before installation.
How do real-time Security Alerts and Webhook integrations work in Ephemere PRO?
Ephemere PRO features automated security dispatchers. The moment an account reaches its maximum login threshold, expires, or is locked by an administrator, an instant email alert is dispatched via wp_mail. Additionally, you can configure an HTTP POST Webhook URL to deliver formatted JSON payloads directly to your team's Slack, Discord, or Zapier channels.
Stop Sharing Admin Passwords Today.
Protect your sites and client assets with temporary, self-destructing access controls. Activate RGBmind Ephemere in under 60 seconds.