Dalmatian Dream User Session Limiter

Configure maximum duration and inactivity in minutes for each user under Session limits. Defaults are 720 minutes maximum and 60 minutes inactivity. Zero disables the corresponding plugin limit; native WordPress expiration still applies. Existing _session_time_limit values remain maximum-duration settings. Each browser/device keeps its own existing WordPress token. Expiring one token preserves the user's other valid tokens. The plugin never creates authentication tokens or synthesizes wp_login/wp_logout events. A local script warns during the final five minutes (or immediately for shorter sessions). Actual keyboard, pointer, touch and scroll input can renew inactivity via authenticated, nonce-protected AJAX. Background Heartbeat and polling do not renew inactivity. Multiple tabs in the same login share an activity marker. Server checks reject expired cookie-authenticated requests even without JavaScript. WP-Cron automatically scans up to 200 users per run every fifteen minutes. Scans advance a persistent cursor; large user populations require multiple runs. MySQL/MariaDB advisory locks prevent overlapping sweeps and serialize this plugin's per-user changes. Compare-and-swap metadata writes protect concurrent token changes. IMPORTANT: WP-Cron depends on traffic or an external trigger. It cannot guarantee logout at the exact deadline on an inactive site. A running browser timer is also subject to browser suspension and throttling. Use system cron for more reliable scheduling, and size the batch/frequency for the site's user count. WP-CLI / system cron wp --path=/absolute/path/to/wordpress dh-usl sweep --batch=200 Run this from the operating system scheduler as the appropriate site account. The batch is clamped to 10..1000 users. A busy run reports busy:true without doing work. System cron remains supported alongside WP-Cron; both use the same sweep and lock. Even system cron is subject to scheduling delay, batch coverage and server availability. Integrations Formerly DH User Session Limiter and DD User Session Limiter. The public name, directory slug and translation domain are now Dalmatian Dream User Session Limiter / dalmatian-dream-user-session-limiter. Existing dh_usl_* hooks, AJAX actions, session fields, options, user metadata and the dh-usl CLI command intentionally retain their identifiers to preserve settings and integrations. The existing dh_usl_session_expired action receives four arguments: integer user ID, SHA-256 token verifier, reason (INACTIVITY, MAX_DURATION or NATIVE_SESSION), and Unix timestamp. No raw token is emitted. Events follow confirmed removal. A second sweep does not repeat an event. This is an at-most-once best effort notification, not a durable message queue: a process crash after removal can lose a notification. All In One WP Security renamed login configuration is respected. Its delete_logged_in_user method is called only when no valid WordPress sessions remain. Because AIOWPS records are user-level, records may remain while another device is active. No artificial login/logout events are fired. Requirements and scope Single-site WordPress only; on multisite the plugin remains inert and displays an administrator notice (activation does not produce a fatal error). Uses the default WP_User_Meta_Session_Tokens backend and MySQL 5.7.5+ or MariaDB 10.0.2+ supporting multiple named GET_LOCK/RELEASE_LOCK locks per connection. Custom session managers and SQLite are not supported. Cookie sessions are covered; Application Passwords are a different authentication mechanism and have no browser session to expire. Admin and subscriber sessions follow the same deadlines. Privacy No external services, telemetry, remote assets, or plugin-originated outbound network requests. Activity requests go only to this site's admin-ajax.php. The plugin stores _dh_usl_max, _dh_usl_idle and legacy _session_time_limit per-user settings and dh_usl_started/dh_usl_last timestamps in existing WordPress session metadata. WordPress itself manages tokens, login time, IP and user-agent data. A sweep cursor is stored in options. A session-scoped HMAC activity key and most recent interaction timestamp are stored in browser localStorage; this is not sent to third parties. Old localStorage markers may remain until site data is cleared. Signed finish URLs contain user ID, a token hash, deadline and signature; servers may record request URLs. They contain no raw token and cannot clear a different browser login. The plugin adds no debug log records. Integration listeners may process expiry events under the site owner's responsibility. Deactivation removes scheduled cleanup and its cursor. Limits and session timestamps are preserved for reactivation. Deleting the plugin also preserves settings; WordPress user deletion removes user metadata. Administrators can delete the three per-user limit keys when permanent removal is wanted. Clear browser site data to remove activity markers. Existing session tokens remain managed by WordPress.

1. Back up the site and test with your integrations on staging.
2. Upload the ZIP via Plugins > Add Plugin > Upload Plugin, or extract the dalmatian-dream-user-session-limiter folder into wp-content/plugins.
3. Activate on a single-site WordPress installation. A recurring cleanup event is registered automatically.
4. Open Session limits as an administrator. Set maximum and idle minutes per user and save the displayed page.
5. Verify separate browser logins and your notification listeners. Configure system cron when reliable scheduled cleanup is needed.

When replacing an older manually installed folder named DH-user-session-limiter, dh-user-session-limiter or dd-user-session-limiter, deactivate it first and replace it with dalmatian-dream-user-session-limiter. Do not run both copies simultaneously. User settings are preserved.

2.3.9

• Updated public name, directory slug and translation domain to Dalmatian Dream User Session Limiter.
• Multisite activation no longer fails with wp_die; unsupported multisite installations remain inert and show an administrator notice.
• Cleanup scheduling failures now show an administrator notice instead of terminating activation.
• Preserved legacy session metadata, hooks, AJAX actions, CLI command and user settings.

2.3.8

• Added bounded WP-Cron cleanup with activation/deactivation lifecycle and shared sweep locking.
• Hardened expiry enforcement, signed finish links, REST authentication and concurrent metadata writes.
• Removed sensitive tracing; added translations, GPL license and operator documentation.

2.3.7

• Original supplied release: per-session limits, activity warnings, AIOWPS adapter and CLI sweep.