Active Sessions

What it does

WordPress tracks who is signed in, but shows you none of it. The core Loggedin plugin’s Force Logout is single-user and all-or-nothing — you have to know the account before you can act on it.

Active Sessions adds a Sessions tab to the Loggedin admin with one row per user who currently holds a live session: their active session count, last login, last IP, email and roles. It’s the answer to “who’s logged in right now?” — and the place to act on the answer.

Find the account fast

The list is a full DataViews table. Search free-text across username, email and display name; sort by username, email, session count or last login. It opens on last login, newest first, because that’s what an admin arriving on this screen is usually looking for.

Hide or reorder columns from the view options menu and choose a page size of 10, 25, 50 or 100. Your view — sort, columns, page size, density — is remembered between visits.

Per-device detail

Open any user and Active Sessions lists each of their sessions separately, newest first: the device, the IP it started from, when it signed in, and when it expires, with a plain-language “in 3 days” hint.

That per-device view is what turns a vague suspicion into a decision. A session from an IP the account holder doesn’t recognise can be ended on its own, without disturbing the browser they’re working in.

Sign out one device, one user, or many

Three levels of action, all confirmed before they run:

• Sign out on a single session ends that one device.
• Sign out all sessions ends every session that user holds — the same effect as the core plugin’s Force Logout.
• Select rows, then Sign out all clears many users in a single action, with a confirmation listing exactly who is about to be signed out.

Every destroy-all path fires the core plugin’s loggedin_destroy_all_sessions action, so audit logging or webhooks you’ve already hooked to Loggedin cover this add-on too.

No extra tables

Sessions are read from WordPress’s own session storage — nothing new is installed, and nothing is left behind if you remove the add-on. The list runs a single query and filters expired tokens in PHP, bounded by the number of users who have ever logged in.

Sites that swap out the session manager for a custom backend — uncommon, and mostly large enterprise hosts — see a notice on the tab instead of a partial list.

Better together

Pair it with Real-time Logout so a sign-out lands on the user’s open tabs within the polling interval rather than at their next click, and with Auto Logout so unattended sessions end themselves before anyone has to go looking for them.