# Limit Active Logins per User in WordPress > Decide how many devices can stay logged in to one account, and end a session when you need to. - URL: https://www.web357.com/limit-active-logins-wordpress-plugin - Platform: WordPress - Edition: Free and PRO - Latest version: 1.0.0 - Compatibility: WordPress 5.x, WordPress 6.x, WordPress 7.x - Price: From €39 per year - Pricing page: https://www.web357.com/limit-active-logins-wordpress-plugin/pricing - Changelog: https://www.web357.com/limit-active-logins-wordpress-plugin/changelog - Documentation: https://docs.web357.com/limit-active-logins-wordpress-plugin/intro/ - wordpress.org: https://wordpress.org/plugins/web357-limit-active-logins/ - Free download: https://wordpress.org/plugins/web357-limit-active-logins/ - Included in: [WordPress All Access Bundle](https://www.web357.com/wordpress-bundle) _One account should not be signed in everywhere at once._ **Limit Active Logins** sets how many devices may stay logged in, and what happens when someone tries to add another. You can also open the session list and end one yourself, without changing their password. If the site is behind **Cloudflare** or another proxy, set how the visitor IP is detected before you trust that column. Set a limit, for example **one device**. The next login can be blocked, can replace the oldest session, or can sign everyone else out. The [documentation](https://docs.web357.com/limit-active-logins-wordpress-plugin/intro/) shows each choice. ## Features ### 📊 Central Control Panel & Real-Time Active Sessions **See who is signed in, on which device.** A shared password is hard to spot without a session list. The [Active sessions](https://docs.web357.com/limit-active-logins-wordpress-plugin/dashboard/) screen shows each login: browser, device, IP, and when it was last used. - Search by name, email, or user ID - Filter by role - Your own admin session is marked, so you do not end it by mistake ![Web357 Limit Active Logins WordPress Plugin - Active Sessions Control Panel and Real-Time Dashboard](https://www.web357.com/content/images/limit-active-logins-dashboard.png) ### 🛡️ Instant Session Termination & Emergency Site-Wide Revocation **End a session without changing the password.** Someone left the company, or a login looks wrong. End that one session, every session of one user, or [every session on the site](https://docs.web357.com/limit-active-logins-wordpress-plugin/dashboard/#log-out-all-users). You stay signed in. - One click, with a confirmation - Several sessions at once - **Log out all users** when you need a clean start ![Web357 Limit Active Logins WordPress Plugin - Remote Session Revocation and Log Out All Users](https://www.web357.com/content/images/limit-active-logins-session-revocation.png) ### ⚙️ Three Enforcement Modes: Block, Allow, or Logout All **Block the new login, or let the newest device win.** Set the limit in [General settings](https://docs.web357.com/limit-active-logins-wordpress-plugin/configuration/general/#login-limit), from **1** to **2,500** devices per account. - **Block:** the new login is refused. The devices already in stay - **Allow:** the new login works, and the oldest session is signed out - **Logout all:** the new login works, and every other session of that account ends A browser left idle gives up its place, so a forgotten tab does not lock the next login. Administrators are exempt, so you cannot lock yourself out while testing. ![Web357 Limit Active Logins WordPress Plugin - General Limit Configuration and Enforcement Modes](https://www.web357.com/content/images/limit-active-logins-settings-general.png) ### 🔑 Custom Block Messages & One-Time Ticket Device Management **Tell people why they cannot sign in, and let them free a device.** *This is in [PRO](https://www.web357.com/limit-active-logins-wordpress-plugin/pricing).* Write the [block message](https://docs.web357.com/limit-active-logins-wordpress-plugin/configuration/block-message/) they see, including the number of devices allowed. After the password is correct, you can list the devices already signed in. Each has a **Log out this device** link that works once, for 10 minutes, and only from that IP. ![Web357 Limit Active Logins WordPress Plugin - Custom Block Message and Login Device List Settings](https://www.web357.com/content/images/limit-active-logins-settings-block-message.png) ### 🎯 Granular Conditional Limits by Role, Location, & IP Whitelist **Different people can have different limits.** *Rules are in [PRO](https://www.web357.com/limit-active-logins-wordpress-plugin/pricing).* A shop manager may need three devices. A subscriber may get one. You can also vary the limit by country, or skip the limit for your office IP. [Conditional limits](https://docs.web357.com/limit-active-logins-wordpress-plugin/configuration/conditional-limits/) run in the order you set. The first match wins. ![Web357 Limit Active Logins WordPress Plugin - Conditional Limits Builder by Role, Country, and IP](https://www.web357.com/content/images/limit-active-logins-settings-conditional-limits.png) ### 👥 Group Concurrent Seat Limits for LMS & Membership Tiers **A shared pool of seats, not one limit per person.** *Group limits are in [PRO](https://www.web357.com/limit-active-logins-wordpress-plugin/pricing).* A classroom plan might allow 25 students online at once, no matter how many accounts exist. When the pool is full, the [group limit](https://docs.web357.com/limit-active-logins-wordpress-plugin/configuration/group-limits/) blocks the next person, or signs out whoever logged in first. ![Web357 Limit Active Logins WordPress Plugin - Group Concurrent Limits and Role Seat Management](https://www.web357.com/content/images/limit-active-logins-settings-group-limits.png) ### ⏱️ Automated Inactivity Invalidation & Idle Logout Dialog **Sign people out when they walk away.** *Idle logout is in [PRO](https://www.web357.com/limit-active-logins-wordpress-plugin/pricing).* It watches real use: typing, clicks, and touch. Background requests, such as a cart refresh, do not count as activity. A countdown appears first, with **Stay logged in**. If the browser never runs that script, the server still ends the session. You can exclude roles such as Administrator in the [Idle logout](https://docs.web357.com/limit-active-logins-wordpress-plugin/configuration/idle-logout/) settings. ![Web357 Limit Active Logins WordPress Plugin - Idle Auto-Logout and Warning Dialog Configuration](https://www.web357.com/content/images/limit-active-logins-settings-idle-logout.png) ### 📱 Front-End Device Lists & Native WooCommerce My Account Tab **Let members see their own devices.** *The customer device list is in [PRO](https://www.web357.com/limit-active-logins-wordpress-plugin/pricing).* Show the [device list](https://docs.web357.com/limit-active-logins-wordpress-plugin/configuration/device-list/) in three ways: - A **Logged-in devices** tab on the WooCommerce My Account page - The shortcode `[web357_lal_devices]` - A **Logged-in devices** block They can sign out another device. The list does not show IP addresses. ![Web357 Limit Active Logins WordPress Plugin - User Device Management and WooCommerce Tab Settings](https://www.web357.com/content/images/limit-active-logins-settings-device-list.png) ### 📈 Comprehensive Login Analytics & Termination Diagnostics **How often people are blocked, and why sessions end.** The [Analytics](https://docs.web357.com/limit-active-logins-wordpress-plugin/analytics/) chart covers 7, 30, or 90 days: logins, blocked attempts, the block rate, and sessions ended. IP addresses are not stored here. Rows older than 90 days are deleted. *Who was blocked most often, and which countries sign in, is in [PRO](https://www.web357.com/limit-active-logins-wordpress-plugin/pricing).* ![Web357 Limit Active Logins WordPress Plugin - Login Analytics Dashboard and Activity Trends](https://www.web357.com/content/images/limit-active-logins-analytics-dashboard.png) ### 👤 Per-User Limit Overrides on Native Profile Screens **One account can be an exception.** On the user profile, choose the site default, a number of your own, or unlimited, as described in [A limit for one user](https://docs.web357.com/limit-active-logins-wordpress-plugin/guides/per-user-limit/). Only someone who can edit users can change it. A member cannot raise their own limit. ![Web357 Limit Active Logins WordPress Plugin - Per-User Limit Override on Edit User Profile Screen](https://www.web357.com/content/images/limit-active-logins-profile-override.png) ## Good to know - **WordPress sessions, not a second list**: The plugin uses the sessions WordPress already creates, including Redis or Memcached. See [how a login is counted](https://docs.web357.com/limit-active-logins-wordpress-plugin/how-logins-are-limited/). - **A forgotten browser gives up its place**: A session idle longer than the [idle threshold](https://docs.web357.com/limit-active-logins-wordpress-plugin/configuration/general/#login-limit) you set is ended when a new login needs it. The default is 30 minutes. - **You can get back in from the server**: Administrators are exempt by default. If you turned that off, WP-CLI can lift the limit, as shown in [Recover from a lockout](https://docs.web357.com/limit-active-logins-wordpress-plugin/guides/wp-cli-commands/#recover-from-a-lockout). ## Free vs PRO | Feature | Free | PRO | | --- | --- | --- | | **Global Concurrent Active Login Limits**: From 1 to 2,500 devices per account. Learn more in [General settings](https://docs.web357.com/limit-active-logins-wordpress-plugin/configuration/general/#login-limit). | ✓ | ✓ | | **Three Limit Enforcement Modes**: **Block** the new login, **Allow** it and end the oldest session, or **Logout all** other sessions. | ✓ | ✓ | | **Dynamic Idle Session Yielding**: A session unused for longer than the time you set gives its place to the next login. | ✓ | ✓ | | **Central Active Sessions Dashboard**: Search, filter by role, and see device, IP, and last activity. Learn more in [Sessions](https://docs.web357.com/limit-active-logins-wordpress-plugin/dashboard/). | ✓ | ✓ | | **Individual & Batch Remote Session Logout**: End one session, or every session of selected accounts. | ✓ | ✓ | | **Emergency Site-Wide Session Revocation**: End every session on the site. Your admin session stays. Learn more in [Log out all users](https://docs.web357.com/limit-active-logins-wordpress-plugin/dashboard/#log-out-all-users). | ✓ | ✓ | | **Per-User Profile Overrides**: Site default, a custom number, or unlimited, on the user profile. Learn more in [One user](https://docs.web357.com/limit-active-logins-wordpress-plugin/guides/per-user-limit/). | ✓ | ✓ | | **Dedicated WP-CLI Commands**: List sessions, log someone out, or lift a limit from the server. Learn more in [Commands](https://docs.web357.com/limit-active-logins-wordpress-plugin/guides/wp-cli-commands/). | ✓ | ✓ | | **Secure Client IP Resolution**: Direct, Cloudflare, or your own proxy. Forged forwarding headers are ignored. Learn more in [Visitor IP](https://docs.web357.com/limit-active-logins-wordpress-plugin/configuration/visitor-ip/). | ✓ | ✓ | | **Login Analytics & Activity Trend Chart**: Logins, blocks, and why sessions ended, for 7, 30, or 90 days. No IP addresses are stored. Learn more in [Analytics](https://docs.web357.com/limit-active-logins-wordpress-plugin/analytics/). | ✓ | ✓ | | **Custom HTML Block Message with Placeholders**: Write the notice people see, including the device limit. Learn more in [Block message](https://docs.web357.com/limit-active-logins-wordpress-plugin/configuration/block-message/). | – | ✓ | | **Login Screen Device List with One-Time Tickets**: After the password is correct, they can log out an old device. The link lasts 10 minutes. | – | ✓ | | **Conditional Limits by Role, Location, & IP**: A different limit for a role, a user, a country, or an office IP. Learn more in [Rules](https://docs.web357.com/limit-active-logins-wordpress-plugin/configuration/conditional-limits/). | – | ✓ | | **Group Concurrent Seat Caps**: Cap how many users of a role may be online at once. Learn more in [Group limits](https://docs.web357.com/limit-active-logins-wordpress-plugin/configuration/group-limits/). | – | ✓ | | **Automated Inactivity Logout with Warning Dialog**: A countdown and **Stay logged in**, then the server ends the session. Learn more in [Idle logout](https://docs.web357.com/limit-active-logins-wordpress-plugin/configuration/idle-logout/). | – | ✓ | | **WooCommerce My Account 'Logged-in devices' Tab**: Customers see their devices and can sign one out. Learn more in [Device list](https://docs.web357.com/limit-active-logins-wordpress-plugin/configuration/device-list/#woocommerce-my-account-tab). | – | ✓ | | **Front-End Shortcode & Gutenberg Block**: Place the same list with `[web357_lal_devices]` or the **Logged-in devices** block. | – | ✓ | | **Automatic Log Out Everywhere on Sign-Out**: Logging out of one device can end every other session of that account. | – | ✓ | | **Pro Analytics: Top Blocked Users & Countries**: Who is blocked most often, and logins by country. Still no IP addresses in analytics. Learn more in [Who and where](https://docs.web357.com/limit-active-logins-wordpress-plugin/analytics/#who-and-where). | – | ✓ | | **Automatic Updates & License Management**: A [PRO](https://www.web357.com/limit-active-logins-wordpress-plugin/pricing) license unlocks updates from the Plugins screen. Help is on the [support page](https://www.web357.com/support). | – | ✓ | ## Pricing Each license is a subscription that renews every year. It includes updates and support while it is active. Prices are in EUR. Buy or compare licenses at https://www.web357.com/limit-active-logins-wordpress-plugin/pricing. | License | Price per year | | --- | --- | | 1 site | €39 | | 3 sites | €59 | | 5 sites | €79 | | Unlimited sites | €99 | ## Frequently asked questions ### Does it work with current WordPress and PHP? Yes. It needs **WordPress 5.6** or newer and **PHP 7.4** or newer, as listed in the [requirements](https://docs.web357.com/limit-active-logins-wordpress-plugin/installation/#requirements). ### Will the limit slow ordinary pages? No. The check runs when someone logs in, not on every page view. [How logins are limited](https://docs.web357.com/limit-active-logins-wordpress-plugin/how-logins-are-limited/) explains the steps. ### Does it work with WooCommerce and membership plugins? Yes. Any login that uses normal WordPress authentication is covered, including WooCommerce, Tutor LMS, MemberPress, Restrict Content Pro, and SureCart. Application passwords and XML-RPC are not counted. They do not open a browser session. ### A customer closed the laptop and now cannot sign in on their phone. They are not stuck. A session idle longer than **Idle sessions give way after** (30 minutes by default) is ended when the new login needs that place. You can [change the minutes](https://docs.web357.com/limit-active-logins-wordpress-plugin/configuration/general/#login-limit) in General settings. ### How do members free a device themselves? In [PRO](https://www.web357.com/limit-active-logins-wordpress-plugin/pricing), the [block message](https://docs.web357.com/limit-active-logins-wordpress-plugin/configuration/block-message/) can list their devices with a one-time logout link. You can also give them a [device list](https://docs.web357.com/limit-active-logins-wordpress-plugin/configuration/device-list/) on My Account. The link is created only after the password is correct, lasts 10 minutes, and works from that IP only. ### Does it work with Redis or Memcached? Yes. Sessions are read and ended through whatever storage WordPress is using, as [How logins are limited](https://docs.web357.com/limit-active-logins-wordpress-plugin/how-logins-are-limited/) explains. ### What is free, and what is PRO? **Free:** the device limit, Block / Allow / Logout all, idle sessions giving way, the session list, per-user exceptions, visitor IP, basic analytics, and WP-CLI. **[PRO](https://www.web357.com/limit-active-logins-wordpress-plugin/pricing):** your own block message, devices on the login screen, limits by role or country, group seats, idle logout with a warning, and a device list for customers. The [documentation](https://docs.web357.com/limit-active-logins-wordpress-plugin/intro/) marks each PRO page. ## Documentation - [Introduction](https://docs.web357.com/limit-active-logins-wordpress-plugin/intro/) - [Installation](https://docs.web357.com/limit-active-logins-wordpress-plugin/installation/) - [How logins are limited](https://docs.web357.com/limit-active-logins-wordpress-plugin/how-logins-are-limited/) - [Active sessions](https://docs.web357.com/limit-active-logins-wordpress-plugin/dashboard/) - [General settings](https://docs.web357.com/limit-active-logins-wordpress-plugin/configuration/general/) - [Conditional limits](https://docs.web357.com/limit-active-logins-wordpress-plugin/configuration/conditional-limits/) - [Idle logout](https://docs.web357.com/limit-active-logins-wordpress-plugin/configuration/idle-logout/) - [Device list](https://docs.web357.com/limit-active-logins-wordpress-plugin/configuration/device-list/) - [FAQ](https://docs.web357.com/limit-active-logins-wordpress-plugin/faq/) --- Part of [Web357](https://www.web357.com). Site map for agents: [llms.txt](https://www.web357.com/llms.txt), [llms-full.txt](https://www.web357.com/llms-full.txt). Documentation: https://docs.web357.com/. Support: https://www.web357.com/support. Append `.md` to any page URL on this site to read it as Markdown.