Hello Mark,

Thank you for reaching out to us.

Can you please test it out now and let me know if it works or not?

Looking forward to your reply.

Hello Mark,

I tested it out and it works fine as the customer panel requires a password for the login.

Please let me know if it works or not.

Looking forward to your reply.

Hi Mark,

We just wish to clarify as many details about this scenario as possible,

in order for us to understand the exact situation, what happens when the Customer who has the issue does this.

-

Can you confirm, when this Customer is doing the test to follow the link from the Email,

is the user already logged in to WordPress on your site?

And is this Customer already existing as a WP User that is connected with the Customer that has the same Email?

If that is the case, then if the WP User is already logged with the credentials,

when they visit the Customer Panel, Amelia will let them to their Customer Panel without a password.

But if they are in an Incognito Browser, or not logged in your Website as a WP user with Customer Role ( who is connected to the Customer of same Email),

in that case, the Panel should ask them to input their password.

-

So it is important to confirm that detail, if you can, please.

The best will be if the user who has the issue records their screen and if you can send us the Video.

If it has any sensitive information, best is to send it as a Private Reply,

and if the video is too large for the ticket, you can upload it to weTransfer and send us a download link?

Thank you.

Hi Mark,

My apologies for the waiting time.

We discussed this with our Senior Team, and are going to do further checks with our QA team and the developers to try to find the best solution going forward.

We will report back as soon as we discuss this further how the default behaviour should be, 

you made a good point with this use case.

Thank you for your patience once again.

Hi Mark,

I am sorry to disappoint you, but it is not currently possible to change the logic of how our "Customer Panel Access" token works from this Notification template.

If we did as you asked, to make that token only let the Customer set up the new password when they use it for the first time,

and then later on, once a password is made, to always make them input the password again,

then it would be impossible for a Customer to make a new password in case if they forgot their existing one.

-

What i mean by that is, let's imagine a scenario where a new Customer follows ( or as you said copies+pastes that token link) from the "Customer Panel Access" Email,

and they set the password for the first time,  in that case, of course the Panel says "your password is successfully set" and lets them in.

-

Later on, if the Customer forgets/loses their password,

the only way for them to make a new password is to follow this token again from "forgot password" button,

which then again triggers the sending of the "Customer Panel access" token from the placeholder in the Notification;

Then it lets them in without the password when they follow the token,

so then they can go in their Profile on the Panel and create a new password via "Configure password" option.

If we remove that possibility, then there would be no way for Customers to reset their password in case they forget/or lose it.

-

But as we mentioned before, that is not a security issue, because that token can only be used if you have access to the Email.

Let me know if you have any further questions,

 or if you have an idea how we might improve all this in the future,

Please feel free to search through our feature suggestion page, 

 to see if someone may be already suggested this feature. If you can't see it, feel free to add your suggestion there, and as more people vote, the feature will move higher on the priority list.

You can certainly follow our changeLog page if you'd like, where we state any changes/new features/bug fixes during updates;

and our newsletter, so you're informed about new features, bug fixes, freebies, etc.

Thank you.