June 26, 2014 by Paul G. | Migrated, Shield Security

User Sessions – Who’s Logged Into My WordPress?

Shield Image

Ever wondered who’s currently logged in to your WordPress site?

If you’re the admin of a WordPress site, then this question has definitely crossed your mind at least once (a day)!

By default, WordPress offers absolutely no way to know this.

The Shield Security let’s you see this and more.

Read on to discover how you can finally get a view on your WordPress users.

How do WordPress user sessions work?

WordPress does not use PHP sessions and does not maintain information (states) from 1 page load to the next – it is completely stateless.

This means that WordPress only cares that each time you load a page, you can verify that you are authenticated with it.

How does it do that?

With Cookies.  When you log into WordPress, it will set a number of cookies on your browser that are checked on each page load.

What’s the advantage of having no WordPress user sessions?

Simplicity, and compatibility with more web hosting environments.

If your users can set cookies, then effectively you can manage WordPress user authentication.

What’s the disadvantage of having no user sessions in WordPress?

There’s a few.  The primary being that since WordPress is stateless, it never knows anything about what has come before.

In this way there is no way to know, by default, who is logged-in, and who is actively using the site right now.

Furthermore, if I can “sniff” your WordPress cookies I can put them on my machine and I’ll be authenticated with your site too.  By default WordPress cannot offset these risks.

Why would you want better control over WordPress User Sessions?

If you want to know who is logged-in, and from where, deeper user sessions management is the only way.

If you want to forcefully log-out certain users for whatever reason, with user session management you can do so without affecting other logged-in users.  For example:

  • You want to log-out idle users (after a certain length of time that you decide)
  • You want to restrict a user session to an IP address (in this way you can’t just sniff cookies and apply them to your browser – unless you’re in the same location)

Let’s say you’re an administrator of a site, and you see that somehow, some way, someone else is logged into the site under your administrator username in another location – you can immediately take action against this.  Without being able to see currently active sessions, you are blind.

User sessions simply give you a view on to who is on your site and where they are.  Until now, this is not possible with WordPress.

How do the Shield Security user sessions work?

The Shield Security creates simple WordPress user sessions.

It does not replace the WordPress user authentication system, but rather augments it.  In this way, we remain 100% compatible with past, current, and future WordPress releases.

When you enable the User Management feature for the first time, you’ll be logged out of WordPress.

This is because you’ve activated the Shield’s user sessions management and it’ll immediately check whether you have an active session in the database.

If it can’t find it, it logs you out – you immediately experience the effects of the user sessions managements.

Once you’re logged-in, however, each time you access the site, it’ll lookup your sessions against the database – to track your session, it places a unique cookie with your session ID. This is matches against your WordPress username and determines the validity of your session.

You can also optionally lock sessions to IP addresses for extra session hardening.

How can I see who is actively logged in to my WordPress site?

On the ‘Users’ section of the plugin, you can view currently active sessions.

It outlines:

  • the time they logged into this session
  • their last activity time
  • the IP address from which they’re accessing the site (which links to an IP Management and Analysis section where you can see all the details for that particular IP)
  • if the user is Security Admin or not

    (if you want to forcefully logout user, just click “Discard” button for that user)
Review and Manage Current WordPress User Sessions
Review and Manage Current WordPress User Sessions

What do you want to see?

If there is a feature that you’d like to see added to user session management, please let us know in the comments below, or contact us directly in our support centre.

We’ve built the Shield Security plugin for WordPress for you… and we’d love to hear what you think, what works, and what doesn’t.

So please tell us! 🙂

ShieldPRO Testimonials
@silencio55's Gravatar @silencio55

Replaced 3-4 Plugins with this Plugin

I feel so confident in this plugin that I removed 3-4 plugins including Akisment, Sucuri, Login Lockdown and Wordfence. Support is excellent. Be Sure to check this plugin out. After reading a recent article on Sucuri about how important it is to have a notification when someone logs into admin…

@gerigurl's Gravatar @gerigurl

Great plugin

Great plugin, simple to use and prevented a couple attacks

@richardevansleefemdomic's Gravatar @richardevansleefemdomic

Thorough Protection

An excellent lean, lightweight full-featured security suite for WP. And you can’t argue with the price: free.

@rajkh's Gravatar @rajkh

Greate And Awesome Plugin

Greate support and smart work such a nice plugin for a wordpress security. i recommend to use this plugin for better wordpress security.

Hey there beautiful! Do you like what you've read here? :)

If this cool feature is something you'd like, but you haven't gone PRO yet, click here to get started today. (no risk, with a 14-day satisfaction guarantee!)

You'll get all PRO features, including Malware Scanning, WP Config Protection, Plugin FileGuard, import/export, customer support, and so much more. Not only that, you'll get that warm, fuzzy feeling that comes from supporting our work and future development.

Make Me Pro →

Comments (3)

    I am impressed by the features mentioned in this article. I am going to give it a try.

    Very nice and thank you very much for this service you have created.

    “You can also optionally lock sessions to IP addresses for extra session hardening.”

    What if all users login from the same internal/local ip or subnet say 192.26.02.0/24 ?

    Thank you

    Will Dangerfield

    Does this work behind cloudflare?

Leave a Comment

Your email address will not be published. Required fields are marked *

Click to access the login or register cheese