# Allow Only One Active Session per User

> Logs a user out of every other browser and device as soon as they log in somewhere new, which stops account sharing.

- Type: PHP
- Runs: Run everywhere
- Category: [Login](https://wpide.com/library/category/login/)
- Tags: login, sessions, security
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/one-session-per-user/

## Code

```php
// Roles that may stay logged in on several devices.
$wpide_multi_session_roles = array( 'administrator' );

add_action( 'set_logged_in_cookie', function ( $cookie, $expire, $expiration, $user_id, $scheme, $token ) use ( $wpide_multi_session_roles ) {
    $user = get_userdata( $user_id );

    if ( ! $user || ! $token || array_intersect( (array) $user->roles, $wpide_multi_session_roles ) ) {
        return;
    }

    WP_Session_Tokens::get_instance( $user_id )->destroy_others( $token );
}, 10, 6 );
```

## Notes

The newest login always wins; the older sessions are ended on their next page load.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Allow Only One Active Session per User" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/