Loggedin – Limit Concurrent Sessions

FAQ

Will this stop users from sharing their WordPress password?

It stops simultaneous sharing — two people can’t be signed in to the same account on different devices at the same time once the cap is set to 1. They can still take turns logging in if you don’t want to block the new login outright. Pick Block New mode to refuse the second login entirely and force the password-sharer to also log out the first device, which most people won’t do.

Does this work with WooCommerce, MemberPress, LearnDash, BuddyPress, etc.?

Yes. Loggedin hooks into the standard WordPress authentication pipeline (wp_authenticate_user and check_password), so any plugin that logs users in through the normal WordPress flow — which is essentially every membership, LMS, e-commerce, and community plugin — is covered automatically. No integration code required.

Can I set different limits for administrators and subscribers?

Yes, with the official Limit Per Role add-on. It adds a per-role panel to the settings page where you can give each WordPress role its own cap (e.g. administrators: 5, editors: 3, subscribers: 1). Users with multiple roles get the highest configured limit.

Can I set a different limit for one specific user?

Yes, with the official Limit Per User add-on. It adds a field to the WordPress profile screen so you can override the global cap on a per-user basis — useful for shared editorial accounts, executive users, or anyone who legitimately needs more sessions than your default.

Will current users be logged out when I install or change the limit?

No. Loggedin only acts when a new login happens. Existing sessions stay active until they expire, the user logs out, or a future login displaces them under the rule you’ve configured.

Where can I find the settings for Loggedin?

In the WordPress admin, go to Users → Loggedin. You’ll see two tabs — Settings for the cap and login logic, and Add-ons for installing and licensing first-party extensions.

What are the available login logic options?

The plugin offers three built-in modes:

• Logout Oldest — When the limit is reached, the user’s single oldest active session is terminated to make room for the new login. Closest match to consumer “remember me” UX.
• Logout All — When the limit is reached, every other active session for the user is terminated and the new login becomes the only active session.
• Block New — When the limit is reached, the new login attempt is rejected with an error on wp-login.

Additional modes can be added via the loggedin_logics filter. See the General Settings docs for details.

How long does a login session last?

The duration of a WordPress login session is controlled by WordPress, not Loggedin.

• “Remember Me” checked at login → session lasts 14 days.
• “Remember Me” not checked → session lasts 2 days.

Customize the duration with the standard auth_cookie_expiration filter:

function custom_auth_cookie_expiration( $expire ) {
    return MONTH_IN_SECONDS; // 30 days for every login.
}

add_filter( 'auth_cookie_expiration', 'custom_auth_cookie_expiration' );

What if a user has reached the limit but doesn’t know which devices are active?

Administrators can force-logout every session for the user from the dashboard:

1. Go to Users → Loggedin in the WordPress admin.
2. Scroll to the Force Logout panel at the bottom of the Settings tab.
3. Enter the user’s ID, email address, or username and click Force Logout. All active sessions for that user are terminated immediately.

Does Loggedin work with Redis / Memcached / external session storage?

Yes for the Logout All and Block New modes — both go through the standard WP_Session_Tokens API, which respects whatever storage backend WordPress is configured to use. The Logout Oldest mode needs the default user-meta storage because the WP API doesn’t expose a “drop the oldest” primitive; pick Logout All instead if your sessions live elsewhere.

Is Loggedin GDPR-compliant?

Loggedin stores no personal data itself. It only counts and manipulates WordPress session tokens that already exist in your database via the standard WP_Session_Tokens API. No external services are called, no telemetry is sent.

Does Loggedin slow down logins?

No. The work Loggedin does on each login is one query for the user’s existing session tokens and an in-memory count — measured in microseconds. No HTTP calls, no cron jobs, no background polling.

Can I customize the error message shown when a login is blocked?

Yes, via the loggedin_error_message filter:

add_filter( 'loggedin_error_message', function ( $message ) {
    return 'Your account is already signed in elsewhere. Sign out from another device to continue.';
} );

See the developer docs for every filter and action the plugin exposes.