June 26, 2014 by Paul G. | Migrated, Shield Security

User Sessions – Who’s Logged Into My WordPress?

Shield Image

Ever wondered who’s currently logged in to your WordPress site?

If you’re the admin of a WordPress site, then this question has definitely crossed your mind at least once (a day)!

By default, WordPress offers absolutely no way to know this.

The Shield Security let’s you see this and more.

Read on to discover how you can finally get a view on your WordPress users.

How do WordPress user sessions work?

WordPress does not use PHP sessions and does not maintain information (states) from 1 page load to the next – it is completely stateless.

This means that WordPress only cares that each time you load a page, you can verify that you are authenticated with it.

How does it do that?

With Cookies.  When you log into WordPress, it will set a number of cookies on your browser that are checked on each page load.

What’s the advantage of having no WordPress user sessions?

Simplicity, and compatibility with more web hosting environments.

If your users can set cookies, then effectively you can manage WordPress user authentication.

What’s the disadvantage of having no user sessions in WordPress?

There’s a few.  The primary being that since WordPress is stateless, it never knows anything about what has come before.

In this way there is no way to know, by default, who is logged-in, and who is actively using the site right now.

Furthermore, if I can “sniff” your WordPress cookies I can put them on my machine and I’ll be authenticated with your site too.  By default WordPress cannot offset these risks.

Why would you want better control over WordPress User Sessions?

If you want to know who is logged-in, and from where, deeper user sessions management is the only way.

If you want to forcefully log-out certain users for whatever reason, with user session management you can do so without affecting other logged-in users.  For example:

  • You want to log-out idle users (after a certain length of time that you decide)
  • You want to restrict a user session to an IP address (in this way you can’t just sniff cookies and apply them to your browser – unless you’re in the same location)

Let’s say you’re an administrator of a site, and you see that somehow, some way, someone else is logged into the site under your administrator username in another location – you can immediately take action against this.  Without being able to see currently active sessions, you are blind.

User sessions simply give you a view on to who is on your site and where they are.  Until now, this is not possible with WordPress.

How do the Shield Security user sessions work?

The Shield Security creates simple WordPress user sessions.

It does not replace the WordPress user authentication system, but rather augments it.  In this way, we remain 100% compatible with past, current, and future WordPress releases.

When you enable the User Management feature for the first time, you’ll be logged out of WordPress.

This is because you’ve activated the Shield’s user sessions management and it’ll immediately check whether you have an active session in the database.

If it can’t find it, it logs you out – you immediately experience the effects of the user sessions managements.

Once you’re logged-in, however, each time you access the site, it’ll lookup your sessions against the database – to track your session, it places a unique cookie with your session ID. This is matches against your WordPress username and determines the validity of your session.

You can also optionally lock sessions to IP addresses for extra session hardening.

How can I see who is actively logged in to my WordPress site?

On the ‘Users’ section of the plugin, you can view currently active sessions.

It outlines:

  • the time they logged into this session
  • their last activity time
  • the IP address from which they’re accessing the site (which links to an IP Management and Analysis section where you can see all the details for that particular IP)
  • if the user is Security Admin or not

    (if you want to forcefully logout user, just click “Discard” button for that user)
Review and Manage Current WordPress User Sessions
Review and Manage Current WordPress User Sessions

What do you want to see?

If there is a feature that you’d like to see added to user session management, please let us know in the comments below, or contact us directly in our support centre.

We’ve built the Shield Security plugin for WordPress for you… and we’d love to hear what you think, what works, and what doesn’t.

So please tell us! 🙂

ShieldPRO Testimonials
@detailscloud's Gravatar @detailscloud

The best plugin and support

I searched a lot about a WordPress plugin to protect the websites that I use, I suffered a lot until I finally found this plugin, it is nice that I was able to use the plugin as a trial for two weeks before buying it, the plugin is more than…

@jonrittmann's Gravatar @jonrittmann

5 Stars to the great firewall

Get this firewall as soon as you create your WP site. . Works great and updates without problems

@poro's Gravatar @poro

Functional security plug-in

This is on of my favourite security plugin for WordPress. Works well so far.

@cristina2988's Gravatar @cristina2988

Great plugin! Recommended

Great plugin, lots of features, what I like the most is that they make everything very easy to understand. I have the pro version and the price is quite good. I 100% recommend it.

Hey there handsome! Do you like what you've read here? :)

If this cool feature is something you'd like, but you haven't gone PRO yet, click here to get started today. (no risk, with a 14-day satisfaction guarantee!)

You'll get all PRO features, including Malware Scanning, WP Config Protection, Plugin FileGuard, import/export, customer support, and so much more. Not only that, you'll get that warm, fuzzy feeling that comes from supporting our work and future development.

Follow Your Dreams (and go pro) →

Comments (3)

    I am impressed by the features mentioned in this article. I am going to give it a try.

    Very nice and thank you very much for this service you have created.

    “You can also optionally lock sessions to IP addresses for extra session hardening.”

    What if all users login from the same internal/local ip or subnet say ?

    Thank you

    Will Dangerfield

    Does this work behind cloudflare?

Leave a Comment

Your email address will not be published. Required fields are marked *

Click to access the login or register cheese