Getting Started
Loggedin is a session manager for WordPress. It gives you control over the login sessions your users hold — how many they can have, how long they last, and how to end them.
Its core job is capping the number of simultaneous WordPress sessions a single user account is allowed to hold. When a new login would exceed the cap, Loggedin either reshuffles the existing sessions to make room or rejects the login outright — your choice. It's the tool of choice when an account is being shared more than it should be, or when compliance requires that a user only be signed in on one device at a time.
Beyond the limit, the plugin can sign out idle sessions and cap how long a login lasts (Auto Logout), force-logout any user's sessions from the admin, show session counts on the Users screen and each user's own devices on their profile (User Sessions), and inspect or end individual sessions from WP-CLI. The Active Sessions add-on extends that into a live view of everyone signed in across the site.
Once the core plugin is active you'll find its settings under Users → Loggedin, a screen with a sidebar of pages:
| Group | Page | What it does |
|---|---|---|
| Settings | Login limits | The concurrent-session limit and the rule applied when it's reached. |
| Lockout & recovery | Leave administrators out of the limit, set the blocked-login message, let blocked users sign out their other devices, and tell signed-out devices why. | |
| Auto logout | Idle logout, session length, and sign-out on password change. | |
| Manage | Sessions | Sign one user, or every user, out of every device. |
| More | Add-ons | The catalog of first-party add-ons: get them, activate licenses, and refresh the list. |
| Help | Documentation and support links, and the versions running on your site. |
See Login Limits for how the screen works.
Loggedin 3.4.0 needs WordPress 6.5 or later and PHP 7.4 or later.
A WordPress REST namespace (/loggedin/v1/…) mirrors the UI so the same settings, force-logout, and addon-licensing operations are available from a terminal, a deployment script, or a third-party integration.
How the limit is enforced
Loggedin attaches to two points in the standard auth pipeline:
wp_authenticate_user— runs early. In Block New mode, this is where the login is rejected with an error on the wp-login screen if the user is already at the cap and typed the right password.attach_session_information— runs as each new session is created. In Logout All or Logout Oldest mode, Loggedin notes the sessions the user already has, and at the end of the request ends them to make room, if the new session is still there. Every login that creates a session passes through it, including social login and magic links that skip the login form. Two-factor plugins that end the new session to ask for a code don't sign out any devices until the code is entered. See Compatibility.
Before 3.4.0, Logout All and Logout Oldest made room on the check_password filter. That filter runs on every password check, not only on logins: a WooCommerce "current password" field, application passwords before WordPress 6.8, or the first step of a two-factor plugin could end sessions without a new login to follow. Since 3.4.0, sessions are ended only when a new one is created.
The verdict on whether the user is "at the cap" passes through the loggedin_reached_limit filter, which is what the Limit Per User and Limit Per Role add-ons hook into to override the global cap on a per-user or per-role basis.
A separate filter, loggedin_bypass, lets you exempt specific users or roles from the check entirely. Administrators are exempt by default on new installs: see Don't limit administrators.
What's next
- Login Limits — the settings screen, the concurrent-session limit and the three login-logic modes (Logout Oldest, Logout All, Block New).
- Lockout & Recovery — administrators, the blocked-login message, self-unlock by email, and the notice for devices signed out by a newer login.
- Auto Logout — idle logout and session length.
- Force Logout — the Sessions page, for clearing every active session for a user, or for every user on the site at once.
- User Sessions — the Users screen columns, "Your sessions" on the profile, and sign-out on password change.
- Compatibility — social login, magic links and other logins that skip the login form.
- WP-CLI — manage sessions and settings from the command line.
- Add-ons — first-party extensions (Active Sessions, Real-time Logout, Limit Per User, Limit Per Role) and how to install / license them.
- Developer Docs — every PHP hook, JS slot, and REST endpoint Loggedin exposes.