Loggedin — Session Manager, Limit Concurrent Logins & Force Logout

A session manager for WordPress — limit concurrent logins, stop account sharing, and force logout any user's active sessions.

Loggedin manages the login sessions your users hold and gives you the tools to end them. Its core job is enforcing a per-account session limit across every device a user signs in from: when the limit is hit, you choose what happens next — block the new login, or kick the oldest session out so the new device can take its place.

Features

• Session management — inspect and end user sessions from the admin UI or WP-CLI.
• Concurrent-session cap — set a global maximum number of simultaneous logins per account.
• Two enforcement modes — block the new login, or auto-logout the oldest active session.
• Force-logout tool — terminate every active session for any user from the admin UI.
• Modern settings UI — built with @wordpress/components and Gutenberg patterns, not a hand-rolled options page.
• REST-backed — all settings flow through the WordPress REST API.
• WP-CLI commands — inspect and destroy sessions and read/write settings from the shell; see WP-CLI.
• Extensible — addons hook into the settings UI via the loggedin.settings.panels JS filter and into the bootstrap via the loggedin_init action.
• Privacy-respecting — no third-party calls beyond Freemius for licensed addons.

Premium addons

Addon	Description
Active Sessions	Browse every user with a live session, drill into each device, and sign out one session — or all of them — in one click.
Limit Per User	Override the global cap for individual users.
Limit Per Role	Set custom caps per WordPress role; highest applicable wins.
Real-time Logout	Detect background-terminated sessions and log the user out immediately.

Requirements

• PHP 7.4+
• WordPress 6.0+

Installation

From WordPress.org

1. Plugins → Add New → search "Loggedin".
2. Install and activate.
3. Configure under Settings → Loggedin.

From source

git clone https://github.com/joel-james/loggedin.git
cd loggedin
composer install --no-dev
npm install && npm run build

Then symlink or copy the directory into wp-content/plugins/ and activate.

WP-CLI

Commands are registered only on WP-CLI requests, so they cost a normal page load nothing.

# Sessions — <user> accepts an ID, username or email address.
wp loggedin sessions list <user>                    # active sessions, newest first
wp loggedin sessions list <user> --field=token      # token hashes only
wp loggedin sessions count <user>
wp loggedin sessions destroy <user> --yes           # sign out everywhere
wp loggedin sessions destroy <user> --token=<hash>  # sign out one device

# Settings
wp loggedin settings list
wp loggedin settings get maximum
wp loggedin settings set maximum 3
wp loggedin settings set logic block                # allow | logout_oldest | block

sessions list supports the standard --format, --fields and --field flags. Destructive commands prompt unless --yes is passed, and settings set refuses a value the sanitizer would reject rather than silently storing the default.

Listing and single-session destroys read the token store directly and need the default user-meta session storage; count and full destroys work with any backend.

Add-ons can register subcommands under the same namespace on the loggedin_cli_init action.

Development

composer install         # PHP dependencies (incl. dev tools)
npm install              # JS dependencies
npm run start            # JS watch build
npm run build            # production JS build
composer test            # PHPUnit
composer run phpcs       # WPCS lint

PHP code follows WordPress Coding Standards (see phpcs.xml.dist). JS uses @wordpress/scripts defaults.

Extending

Addons register themselves via two hooks wired at file load:

// Register with the parent's Freemius-addons map.
add_filter( 'loggedin_register_addon', [ Plugin::class, 'register_addon' ] );

// Boot once the parent's modules are ready.
add_action( 'loggedin_init', [ Plugin::class, 'boot' ] );

Addons can contribute a panel to the Settings tab from JS:

import { addFilter } from '@wordpress/hooks';

addFilter(
    'loggedin.settings.panels',
    'my-addon/panel',
    ( panels ) => [ ...panels, { id: 'my-addon', Component: MyPanel } ]
);

Contributing

Pull requests welcome. Please read contributing.md and run composer test + composer run phpcs before opening a PR.

Security

If you discover a security issue, please follow the disclosure process in security.md rather than opening a public issue.

License

GPL-2.0+ © Joel James