Limit Active Logins per User in WordPress

See who is signed in, on which device.

A shared password is hard to spot without a session list. The Active sessions screen shows each login: browser, device, IP, and when it was last used.

• Search by name, email, or user ID
• Filter by role
• Your own admin session is marked, so you do not end it by mistake

Block the new login, or let the newest device win.

Set the limit in General settings, from 1 to 2,500 devices per account.

• Block: the new login is refused. The devices already in stay
• Allow: the new login works, and the oldest session is signed out
• Logout all: the new login works, and every other session of that account ends

A browser left idle gives up its place, so a forgotten tab does not lock the next login. Administrators are exempt, so you cannot lock yourself out while testing.

Different people can have different limits.

Rules are in PRO. A shop manager may need three devices. A subscriber may get one. You can also vary the limit by country, or skip the limit for your office IP.

Conditional limits run in the order you set. The first match wins.

Sign people out when they walk away.

Idle logout is in PRO. It watches real use: typing, clicks, and touch. Background requests, such as a cart refresh, do not count as activity.

A countdown appears first, with Stay logged in. If the browser never runs that script, the server still ends the session. You can exclude roles such as Administrator in the Idle logout settings.

How often people are blocked, and why sessions end.

The Analytics chart covers 7, 30, or 90 days: logins, blocked attempts, the block rate, and sessions ended. IP addresses are not stored here. Rows older than 90 days are deleted.

Who was blocked most often, and which countries sign in, is in PRO.