About this plugin
Loggedin is a free session and login manager for WordPress. It limits how many devices one account can be signed in on at the same time, signs out idle users automatically, and lets administrators sign any user out of every device. It stops account sharing on membership sites, online courses and subscription stores, without slowing logins down.
Loggedin works with the sessions WordPress already creates, through the standard WP_Session_Tokens API. It needs no cron jobs, no background polling and no external services, and it works with any theme and host.
Loggedin at a glance
- What it does: limits concurrent logins per account, logs out idle users, and manages every signed-in device.
- Price: free. Optional add-ons add per-role limits, per-user limits, a live sessions view and real-time logout.
- Default: one device per account. A new login signs out the others.
- Where the settings are: Users → Loggedin in the WordPress admin.
- Requirements: WordPress 6.5 or later, PHP 7.4 or later.
- Privacy: no external calls, no tracking, no data sent anywhere.
- Made by: Foxe Labs. Active since 2016.
What you can do with Loggedin
Limit concurrent logins
- Set how many devices an account can be signed in on at once, from 1 upwards.
- Choose what happens when someone goes over the limit:
- Logout Oldest signs out the oldest device and lets the new login in.
- Logout All signs out every other device, so the new login is the only one.
- Block New refuses the new login and shows a message on the login screen.
- Leave administrators out of the limit, so nobody is locked out of their own site.
- Covers social login, magic-link and popup login plugins too, under Logout Oldest and Logout All.
Auto logout idle users
- Sign out sessions nobody has used for a set number of minutes.
- Show a countdown warning before the logout happens.
- Give each role its own idle timeout.
- The check runs on the server, so a forgotten open tab doesn’t keep a session alive.
- Set how long a login lasts, with and without “Remember Me”.
Force logout and session management
- End every session of any user from the Sessions page, the Users screen or WP-CLI.
- Log out all users on the site at once, instantly, even with thousands of accounts. Your own session stays signed in.
- See each user’s session count and last login on the Users screen, with a sortable Last login column.
- Sign users out everywhere one at a time or with a bulk action.
- Sign users out of their other devices when their password changes or is reset.
Lockout recovery
- A user blocked by the limit can email themselves a link that signs out their other devices. It is offered only after the right password, and the link expires after 15 minutes.
- Write your own blocked-login message, with links.
- Tell users why they were signed out (“your account signed in on another device”), or send them to a page you choose.
For your users
- “Your sessions” on the profile screen lists each device a user is signed in on, where and when, with a Sign out button for each.
For developers
- WP-CLI commands: wp loggedin sessions list, wp loggedin sessions destroy, wp loggedin sessions destroy-all and wp loggedin settings.
- A REST API under loggedin/v1.
- Documented actions and filters for every decision: change the limit per user or role, exempt service accounts, log forced logouts, or add your own login rule. See the developer docs.
How the concurrent login limit works
WordPress creates a session each time someone logs in: one per browser, per device. A phone and a laptop are two sessions. Two browsers on one laptop are two sessions too.
Closing a tab doesn’t end a session; it stays until the user logs out, it expires, or something ends it.
On every login, Loggedin counts the account’s active sessions and compares the count with your limit. If the new login would go over it, Loggedin applies the rule you picked: sign out the oldest device, sign out every other device, or refuse the new login.
Changing the limit never signs anyone out on the spot. It applies from the next login.
Who uses Loggedin
- Membership sites on MemberPress, Paid Memberships Pro, Restrict Content Pro, s2Member or WooCommerce Memberships, to stop one paid account being shared by a group.
- Online courses and LMS sites on LearnDash, LifterLMS, Tutor LMS or Sensei, so each seat is used by the person who paid for it.
- Subscription stores on WooCommerce Subscriptions or Easy Digital Downloads, to keep subscriber accounts personal.
- Intranets and client portals that need one device at a time per staff or client account.
- Communities on BuddyPress or BuddyBoss, to cut down on shared and duplicate accounts.
- Sites with security or compliance rules (healthcare, finance, education) that require a session limit and an idle timeout.
Add-ons
Loggedin is complete on its own. These official add-ons extend it:
- Active Sessions: see who is logged in right now, every device for each user, and sign out one session or all of them.
- Limit Per Role: give each WordPress role its own concurrent login limit.
- Limit Per User: set a different limit for one user from their profile.
- Real-time Logout: when a session ends, the user’s other open tabs go to the login screen straight away.
Documentation
- Getting started
- Login limits
- Lockout and recovery
- Auto logout
- Force logout
- Users screen and profile sessions
- Compatibility with social, magic-link and popup logins
- WP-CLI commands
- Add-ons
- Developer docs: hooks, filters and REST API
Bug reports
Report bugs on GitHub. org support forum.