Loggedin - Session Manager: Limit Concurrent Logins & Auto Logout

Install and activate Loggedin, go to Users → Loggedin → Login limits, set the maximum number of active logins and choose a login logic: Logout Oldest, Logout All or Block New. Save. The limit applies from each user's next login.

Set the limit to 1. With Logout All or Logout Oldest, a second person logging in signs the first one out, so sharing one account becomes annoying fast. With Block New, the second login is refused until the first device signs out. Loggedin works with MemberPress, Paid Memberships Pro, WooCommerce, LearnDash and other plugins that log users in through WordPress.

Go to Users → Loggedin → Auto logout, turn on idle logout and set the timeout in minutes. Users see a countdown before they are signed out, and each role can have its own timeout. It's free and built in since version 3.4.0.

Go to Users → Loggedin → Sessions, enter the user's ID, email or username under Force Logout and click the button. Every session of that user ends immediately. You can also use Sign out everywhere on the user's row on the Users screen, or run wp loggedin sessions destroy <user>.

Click Logout All Users on Users → Loggedin → Sessions, or run wp loggedin sessions destroy-all. It finishes instantly at any number of users because it sets one site-wide cut-off time instead of looping through accounts. Your own session stays signed in.

The Users screen shows each user's number of active sessions and their last login. Each user sees their own devices under Your sessions on their profile. For a live list of everyone signed in right now, with every device, add the Active Sessions add-on.

Yes, with the Limit Per Role add-on. Each role gets its own limit, for example 5 for administrators and 1 for subscribers. A user with several roles gets the highest. To leave administrators out of the limit altogether, turn on Don't limit administrators in the free plugin.

Yes, with the Limit Per User add-on, which adds a limit field to the user's profile.

If self-unlock is on, the error shows a link after the right password. The user gets an email with a link that signs out all their devices, and can then log in. An administrator can also force logout the user from the Sessions page.

Someone logged in to your account on another device, and the site allows only a set number of devices at once, so this one was signed out. If it wasn't you, change your password.

No. Loggedin acts only when someone logs in. Existing sessions stay until they expire, the user logs out or a later login replaces them. Turning on auto logout gives every session the full timeout from the moment you save.

Yes. Any plugin that logs users in through WordPress is covered with no extra setup. Social login, magic-link and popup login plugins are covered under Logout Oldest and Logout All; Block New can refuse them only when the plugin checks first, as Nextend Social Login does. Tested with WooCommerce, Ultimate Member, Nextend Social Login, Magic Login, Two Factor, Limit Login Attempts Reloaded, WPS Hide Login and User Switching. See compatibility.

No. Limit login attempts plugins block repeated wrong passwords to stop brute-force attacks. Loggedin limits how many devices a valid account can be signed in on at the same time. They do different jobs and work well together.

Yes for Logout All, Block New, force logout and log out all users, which go through the standard WP_Session_Tokens API. Logout Oldest and the per-device lists need WordPress's default session storage in user meta.

No. Loggedin does its main work when someone logs in or out, and on its own admin screens. On other pages it only reads its settings and, with auto logout on, the signed-in user's last activity. There's no cron, no polling and no remote request. With auto logout on, a small script tracks activity in the browser and checks in with the server at most once a minute while the page is in use.

Loggedin calls no external services and sends no data anywhere. It uses the session records WordPress already keeps, which hold the IP address and browser of each login, and stores each user's last login time and, with auto logout on, when each session was last active. The profile screen shows only part of the IP address. Mention WordPress sessions in your privacy policy as you would without the plugin.

By default, 14 days with "Remember Me" checked and 2 days without. Change both under Users → Loggedin → Auto logout → Session length, or with the auth_cookie_expiration filter.

Yes, under Users → Loggedin → Lockout & recovery. Developers can also use the loggedin_error_message filter: php add_filter( 'loggedin_error_message', function ( $message ) { return 'Your account is already signed in on another device.'; } );

Yes. wp loggedin sessions lists, counts and ends a user's sessions, and wp loggedin settings reads and changes settings. Commands that end sessions ask for confirmation unless you pass --yes. Run wp help loggedin or see the WP-CLI docs.