How to limit simultaneous member logins in WordPress

Decide whether one member may use one session only, or whether you will allow two or three devices. Then choose what happens when the limit is reached: reject the new login, or end the oldest session.

Rejecting the new login is clearer for account-sharing prevention. Ending the oldest session is less frustrating for members who have forgotten to sign out elsewhere.

WordPress stores session tokens for each user and can list or destroy them. The core functions include wp_get_all_sessions(), wp_destroy_other_sessions(), and wp_destroy_all_sessions(), but WordPress does not provide a dashboard setting for a maximum number of active sessions.

Do not confuse this task with limiting failed login attempts. Brute-force protection counts incorrect passwords; simultaneous-login control counts active authenticated sessions.

For a custom solution, create a small site plugin rather than editing the theme or WordPress core. Use the wp_authenticate_user filter to check the authenticated user before login completes, inspect that user's session tokens, and return a WP_Error when the allowed count has already been reached. WordPress documents this filter as the point for additional checks before a user is logged in.

If your rule ends the oldest session instead, run the session-removal logic after a successful login and retain the newly created session. Account for concurrent requests, custom login forms, REST or application-password access, and membership plugins that perform their own authentication. This route is workable, but it needs careful development and ongoing testing.

The faster route is a plugin that specifically manages concurrent WordPress sessions. Install it from Plugins → Add New, activate it, and look for settings named along the lines of session limit, concurrent logins, active sessions, or force logout.

Set the global limit, choose whether to block the new login or terminate the oldest session, and exclude administrators if the plugin supports role exclusions. Confirm that it controls active sessions rather than only failed login attempts.

If your members use Paid Memberships Pro, its Limit Logins controls are a suitable fast option for limiting active member sessions. Configure the allowed session count and the action taken when the limit is exceeded. Use the session-limit controls for account sharing; failed-attempt lockout settings solve a different problem.

Keep an administrator account outside the restriction where possible. Otherwise, a stale session or an incorrect limit can lock you out of the dashboard when you need to fix it.

Create a test member account and sign in from two browsers or one browser plus a private window. Check the result at the limit, then sign out and confirm that a new login is allowed. Also test the member area, password reset, mobile layout, cached pages, and any custom login form.

A common support problem is that an old session is destroyed in the database but the other browser appears logged in until it makes another request. Test a page refresh or navigation before assuming the control has failed. If you are locked out, use the plugin's session-reset tool, the Users screen, WP-CLI session commands, or temporarily disable the custom control.