Session management for WordPress
Limit concurrent logins per account, harden session cookies, detect hijacked sessions, and see who is on your site right now with the Who's Online presence view.
Session automations (rules that act on sessions for you) are Pro.
What it does
A leaked password often shows up as a second login from somewhere new while the real user is still working. Concurrent-login limits close that door: set how many simultaneous sessions an account may hold, and choose whether an over-limit login is blocked or silently replaces the oldest session.
The presence side answers a simpler question every admin asks: who is on the site right now? A live view shows current users, fed by the WordPress Heartbeat API, with idle detection.
How it works
Session cookies can be re-issued with HttpOnly, forced Secure and your choice of SameSite policy. Session binding fingerprints the IP address and/or browser at login and verifies it on every request. A mismatch is treated as a hijacked session. Administrators can be exempted from limits, and the block message is customizable.
Everything is manageable over the REST API too: list active sessions, revoke one, revoke all sessions for a user, or emergency-purge everything.
- Per-account session caps with block-new or drop-oldest behavior
- Cookie hardening: HttpOnly, Secure, SameSite
- Session binding to IP and/or user agent with hijack detection
- Who's Online presence with idle detection
- Session REST API including emergency purge
Free today, deeper with Pro
Pro adds session automations (saved rules that act on sessions automatically, with bulk revocation) for teams managing many accounts.
Documentation
Session management questions
What happens when someone exceeds the session limit?
Your choice: the new login is blocked with a customizable message, or the oldest session is quietly dropped to make room.
Will session binding break users on mobile networks?
IP binding can be strict on networks that rotate addresses. That is why IP and user-agent binding are separate toggles. Bind to the browser only if your users roam.
Related features
Secure your site today
Install the free plugin from WordPress.org and set up real protection with the guided setup wizard. Upgrade to Pro whenever you need more.