Loggedin - Limit Concurrent Sessions

It stops simultaneous sharing — two people can't be signed in to the same account on different devices at the same time once the cap is set to 1. They can still take turns logging in if you don't want to block the new login outright. Pick Block New mode to refuse the second login entirely and force the password-sharer to also log out the first device, which most people won't do.

Yes. Loggedin hooks into the standard WordPress authentication pipeline (wp_authenticate_user and check_password), so any plugin that logs users in through the normal WordPress flow — which is essentially every membership, LMS, e-commerce, and community plugin — is covered automatically. No integration code required.

Yes, with the official Limit Per Role add-on. It adds a per-role panel to the settings page where you can give each WordPress role its own cap (e.g. administrators: 5, editors: 3, subscribers: 1). Users with multiple roles get the highest configured limit.

Yes, with the official Limit Per User add-on. It adds a field to the WordPress profile screen so you can override the global cap on a per-user basis — useful for shared editorial accounts, executive users, or anyone who legitimately needs more sessions than your default.

No. Loggedin only acts when a new login happens. Existing sessions stay active until they expire, the user logs out, or a future login displaces them under the rule you've configured.

In the WordPress admin, go to Users → Loggedin. You'll see two tabs — Settings for the cap and login logic, and Add-ons for installing and licensing first-party extensions.

The plugin offers three built-in modes:

• Logout Oldest — When the limit is reached, the user's single oldest active session is terminated to make room for the new login. Closest match to consumer "remember me" UX.
• Logout All — When the limit is reached, every other active session for the user is terminated and the new login becomes the only active session.
• Block New — When the limit is reached, the new login attempt is rejected with an error on wp-login.

The duration of a WordPress login session is controlled by WordPress, not Loggedin.

• "Remember Me" checked at login → session lasts 14 days.
• "Remember Me" not checked → session lasts 2 days.

Administrators can force-logout every session for the user from the dashboard:

1. Go to Users → Loggedin in the WordPress admin.
2. Scroll to the Force Logout panel at the bottom of the Settings tab.
3. Enter the user's ID, email address, or username and click Force Logout. All active sessions for that user are terminated immediately.

Yes for the Logout All and Block New modes — both go through the standard WP_Session_Tokens API, which respects whatever storage backend WordPress is configured to use. The Logout Oldest mode needs the default user-meta storage because the WP API doesn't expose a "drop the oldest" primitive; pick Logout All instead if your sessions live elsewhere.

Loggedin stores no personal data itself. It only counts and manipulates WordPress session tokens that already exist in your database via the standard WP_Session_Tokens API. No external services are called, no telemetry is sent.

No. The work Loggedin does on each login is one query for the user's existing session tokens and an in-memory count — measured in microseconds. No HTTP calls, no cron jobs, no background polling.

Yes, via the loggedin_error_message filter: add_filter( 'loggedin_error_message', function ( $message ) { return 'Your account is already signed in elsewhere. Sign out from another device to continue.'; } ); See the developer docs for every filter and action the plugin exposes.