Loggedin – Session Manager, Limit Concurrent Logins & Force Logout

BUJ

Is Loggedin a full session manager?

It manages the sessions WordPress already creates, rather than replacing WordPress’s session handling. Here’s exactly what’s in the free plugin:

• Limit how many sessions an account can hold at once, and choose what happens when the limit is reached.
• Force logout every session for any user, from the admin or from WP-CLI.
• Inspect a user’s active sessions — login time, expiry, IP and device — via wp loggedin sessions list.

For a live, sortable view of every signed-in user across the site, with per-device detail and one-click sign-out, add the Active Sessions add-on. Idle timeouts and login alerts are on the roadmap as add-ons too.

If all you need is to cap concurrent logins and stop account sharing, the free plugin does that on its own — no add-on required.

Will this stop users from sharing their WordPress password?

It stops simultaneous sharing — two people can’t be signed in to the same account on different devices at the same time once the cap is set to 1. They can still take turns logging in if you don’t want to block the new login outright. Pick Block New mode to refuse the second login entirely and force the password-sharer to also log out the first device, which most people won’t do.

Does this work with WooCommerce, MemberPress, LearnDash, BuddyPress, etc.?

Yes. Loggedin hooks into the standard WordPress authentication pipeline (wp_authenticate_user and check_password), so any plugin that logs users in through the normal WordPress flow — which is essentially every membership, LMS, e-commerce, and community plugin — is covered automatically. No integration code required.

Can I set different limits for administrators and subscribers?

Yes, with the official Limit Per Role add-on. It adds a per-role panel to the settings page where you can give each WordPress role its own cap (e.g. administrators: 5, editors: 3, subscribers: 1). Users with multiple roles get the highest configured limit.

Can I set a different limit for one specific user?

Yes, with the official Limit Per User add-on. It adds a field to the WordPress profile screen so you can override the global cap on a per-user basis — useful for shared editorial accounts, executive users, or anyone who legitimately needs more sessions than your default.

Will current users be logged out when I install or change the limit?

No. Loggedin only acts when a new login happens. Existing sessions stay active until they expire, the user logs out, or a future login displaces them under the rule you’ve configured.

Where can I find the settings for Loggedin?

In the WordPress admin, go to Users → Loggedin. You’ll see two tabs — Settings for the cap and login logic, and Add-ons for installing and licensing first-party extensions.

What are the available login logic options?

The plugin offers three built-in modes:

• Logout Oldest — When the limit is reached, the user’s single oldest active session is terminated to make room for the new login. Closest match to consumer “remember me” UX.
• Logout All — When the limit is reached, every other active session for the user is terminated and the new login becomes the only active session.
• Block New — When the limit is reached, the new login attempt is rejected with an error on wp-login.

Additional modes can be added via the loggedin_logics filter. See the General Settings docs for details.

How long does a login session last?

The duration of a WordPress login session is controlled by WordPress, not Loggedin.

• “Remember Me” checked at login → session lasts 14 days.
• “Remember Me” not checked → session lasts 2 days.

Customize the duration with the standard auth_cookie_expiration filter:

`php

function custom_auth_cookie_expiration( $expire ) {
return MONTH_IN_SECONDS; // 30 days for every login.
}

add_filter( ‘auth_cookie_expiration’, ‘custom_auth_cookie_expiration’ );
`

What if a user has reached the limit but doesn’t know which devices are active?

Administrators can force-logout every session for the user from the dashboard:

1. Go to Users → Loggedin in the WordPress admin.
2. Scroll to the Force Logout panel at the bottom of the Settings tab.
3. Enter the user’s ID, email address, or username and click Force Logout. All active sessions for that user are terminated immediately.

Does Loggedin work with Redis / Memcached / external session storage?

Yes for the Logout All and Block New modes — both go through the standard WP_Session_Tokens API, which respects whatever storage backend WordPress is configured to use. The Logout Oldest mode needs the default user-meta storage because the WP API doesn’t expose a “drop the oldest” primitive; pick Logout All instead if your sessions live elsewhere.

Does Loggedin support WP-CLI?

Yes, since 3.1.0. Every command lives under wp loggedin — wp loggedin sessions lists, counts and destroys a user’s active sessions, and wp loggedin settings reads and writes the plugin settings. Destructive commands prompt for confirmation unless you pass --yes.

See the WP-CLI documentation for the full command reference, options and scripting examples, or run wp help loggedin in your terminal.

Is Loggedin GDPR-compliant?

Loggedin stores no personal data itself. It only counts and manipulates WordPress session tokens that already exist in your database via the standard WP_Session_Tokens API. No external services are called, no telemetry is sent.

Does Loggedin slow down logins?

No. The work Loggedin does on each login is one query for the user’s existing session tokens and an in-memory count — measured in microseconds. No HTTP calls, no cron jobs, no background polling.

Can I customize the error message shown when a login is blocked?

Yes, via the loggedin_error_message filter:

`php

add_filter( ‘loggedin_error_message’, function ( $message ) {
return ‘Your account is already signed in elsewhere. Sign out from another device to continue.’;
} );
`

See the developer docs for every filter and action the plugin exposes.