Tell me more ×
WordPress Answers is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.
up vote 4 down vote favorite
2

On a site with premium user account subscriptions, I'd like to be able to limit logins to one computer at a time. The most straightforward way to accomplish this would be to limit by IP, but I haven't had any luck finding a plugin to accomplish this. Does anybody know of one I can use to get this functionality?

Related: Login security question - Does WP show me if I'm logged in from multiple locations?

share|improve this question
This one at least binds the cookies to the IP. Probably it is of use: w-shadow.com/blog/2008/07/12/safer-cookies-plugin-for-wordpress – hakre Nov 18 '10 at 21:21
Hm - it's close, but it does not disallow sessions for the same user on multiple IPs. I'm logged in on my desktop and iPhone on 3G right now without issue. – Gavin Nov 19 '10 at 15:41
Well I was certain, that it won't solve your issue, but that it is something in the direction. I've searched for more, but didn't found anything. Wait, this one stores (at least failed) IPs of logins into the database. This can be of use as well to write a plugin that does what you wants: wordpress.org/extend/plugins/login-lockdown – hakre Nov 19 '10 at 20:10
I have a question back: Let's say your site has the user Gavin with the IP-A. Should no other user including Gavin be able to login from another ip, or should only a "second Gavin" not be able to login from another ip then IP-A? – hakre Nov 19 '10 at 20:18
Only other 'Gavin' instances should not be able to log in. It wouldn't reject access though, but rather change the 'active IP' and log the other session out. – Gavin Nov 22 '10 at 18:31

1 Answer

up vote 4 down vote accepted

As already suggested in a comment above of mine, technically a (cookie based) session is limited to one IP at a time by using the Safer Cookies (Wordpress Plugin).

This does not prevent to allow another login with the same username and password because it is a feature of wordpress to allow you to login multiple times with your credentials and therefore with multiple IPs.

What you would like to achieve is to prevent multiple logins at all then. According to Otto, this is not trivial. Stacy writes, that the Wishlist Member (Wordpress Plugin) has such a functionality built in: IP-Login Protection. So probably that plugin or part thereof is a solution to your issue. IANAL, but that plugin is violating the GPL license as it restricts you to make use of your wordpress derivate. I would not use it.

But probably there is another plugin out there available, or it's quite easy to extend Login LockDown (Wordpress Plugin) to bind the whole session to the last valid IP recorded.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.