Allow Only One Active Session per User
Logs a user out of every other browser and device as soon as they log in somewhere new, which stops account sharing.
Opens WPIDE on
Code
// Roles that may stay logged in on several devices.
$wpide_multi_session_roles = array( 'administrator' );
add_action( 'set_logged_in_cookie', function ( $cookie, $expire, $expiration, $user_id, $scheme, $token ) use ( $wpide_multi_session_roles ) {
$user = get_userdata( $user_id );
if ( ! $user || ! $token || array_intersect( (array) $user->roles, $wpide_multi_session_roles ) ) {
return;
}
WP_Session_Tokens::get_instance( $user_id )->destroy_others( $token );
}, 10, 6 );Notes
The newest login always wins; the older sessions are ended on their next page load.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.