Does anyone know of a way to force a logged in user to re-login after say 4 hours? or at a particular time to day?

For example, if they logged in at 9am, can we force them to re-login at 1pm?

4 Answers 4


The easiest way is to change the authentication cookie expiry time.

add_filter('auth_cookie_expiration', 'wase_85171_expiry',10,3);

function wase_85171_expiry($expiry, $user_id, $remember) {
  return 14400; // or calculate the time remaining till the time you want it to expire

People can extend the cookie expiry in the browser, but I don't believe anyone will bother

  • where do I add this code?
    – J. Chin
    Feb 10, 2013 at 16:23
  • at your themes functions.php file Feb 10, 2013 at 20:01

You can write javascript which will start on wp_login action, count 4x60x60 seconds and redirect user to URL generated by wp_logout_url().

Update: it's a good idea to force logout only after N minutes the user is idle. You can get the idea and link to source code in jQuery idleTimer plugin article by Paul Irish. Unfortunately, demo does not work.

  • this is a good idea, complementary to what J.Chin Asked for. But I'm pretty sure it would be safer on the server side (in PHP then). Ben Then JS could still be used in order to hide still opened page
    – Christian
    Feb 9, 2013 at 9:10

You can programatically logout a user in Wordpress by calling the wp_logout() function. To apply this to your 4 hour rule, consider the following code:

function user_update_login($login) {
    // function fires when a user logs in

    global $user_ID;
    $user = get_userdatabylogin($login);

    // save the current time when the user logged in
    update_usermeta( $user->ID, 'last_login', time() );

function check_time_limit() {
    // populate the user objects
    global $user_ID;

    // only run if the user is logged in
    if($user_ID) {
        // get the last login time
        $last_login = get_user_meta($user_ID, 'last_login', TRUE);

        // if the current time is greater than the last login
        // + 14400 seconds (4 hours) the user will be logged out
        if(time() > ($last_login + 14400)) {

Putting this code in your functions.php file will log ALL users out after 4 hours. You could also move the call to check_time_limit() anywhere within your theme if you only want this rule to apply to specific pages etc.

  • no because it only fires if $user_ID is set, i.e the user has to be logged in again before the check will run and thereby the last_login meta value will be updated first. works fine for me.
    – tobbr
    Feb 9, 2013 at 11:05
  • yes, after another 4 hours, thats the whole point.
    – tobbr
    Feb 9, 2013 at 11:11
  • lol, my mistake, going to delete it Feb 9, 2013 at 11:11

You can simply use a plugin named WP Login Timeout Settings. you can set timeout for the loggedin user to re-login.

Not the answer you're looking for? Browse other questions tagged or ask your own question.