How can I use code to limit users from sharing there ids and password and login muliple times? what i want to do is not allow the user to login multiple times at the same time.

5 Answers 5


This will log a user out of all other sessions before logging in. Essentially ensuring that a user will only be allowed one session at a time.

add_filter('authenticate', 'wpse_12282015_single_login_authenticate', 0, 3);

function wpse_12282015_single_login_authenticate($user, $username, $password) {

    $user =  get_user_by('login', $username);

    if( isset($user->ID) ){

        if(isset($user->roles) && is_array($user->roles)) {

            //check for admins
            if(in_array('administrator', $user->roles)) {

                // admin can log in more than once
                return $user;

        // get all sessions for user
        $sessions = WP_Session_Tokens::get_instance($user->ID);

        // destroy everything since we'll be logging in shortly

    return $user;
  • Somehow this codes allows user to login without password on Wordpress 4.9x
    – th3pirat3
    Aug 1, 2018 at 11:16
$sessions = WP_Session_Tokens::get_instance( $user->ID );

if ( $user->ID === get_current_user_id() ) {
    $sessions->destroy_others( wp_get_session_token() );
    $message = __( 'You are now logged out everywhere else.' );
} else {
    /* translators: %s: User's display name. */
    $message = sprintf( __( '%s has been logged out.' ), $user->display_name );

The main problem here is that HTTP has no sessions and therefor you need to introduce some session start and end at a higher level. The way wordpress defines sessions is for 2 days after a login or until a logout.

The problem is that users very rarely logout of wordpress which means that once a user had logged in it is impossible to use his account from another computer, or even another browser at the same computer for 2 days even if it is the same user trying to gain access again.

So the devil here is in the details, how are you going to prevent logged in sessions from continuing forever, maybe at the cost of UX, or how a user can "close" a session from another browser.Robert's answer (and Otto) is totally wrong, you can do that using the existing hooks but the naive approaches (for example set a transient when a user logins) will probably lead to an usability disaster.


For anyone reaching this page looking for an answer, there's this plugin that does exactly that: https://wordpress.org/support/plugin/loggedin/


By Otto.

Not, easy. Quite a lot of hacking would be needed.

WordPress doesn't have any idea who's "logged in" at any one time, because there's no system for tracking that in any way. When you log in, a cookie is set on your browser with your username and a code representing your password. Every time you access the site, that cookie is checked and you are identified as you.

So, it's not like you're maintaining a permanent connection or using some kind of session. You're "logging in" every single time you hit the site for anything.

To do what you're wanting, you'd have to rewrite a lot of the login and authentication system to use sessions or something similar.

WordPress does not have such system to store sessions in database, by default.

  • $_SESSION gets unset by core... also this isn't really an answer. It's more like "you can do it, but it's hard". Please take some time to (a) add citations if you think it is not possible, or (b) show how it could be possible.
    – kaiser
    Sep 3, 2014 at 17:47
  • I understand but i'm working on my own login plugin right now but need some direction. I would like to a column in the data base that would when user logs in sets value to one and zero when loged out
    – user59167
    Sep 3, 2014 at 17:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.