WordPress Session Manager

The Story

It started with a frustrated email from a client running a membership site. “We have 50 paying members, but our analytics show 200+ unique visitors accessing premium content. How is this possible?”

The answer was simple: password sharing. Members were casually handing out their credentials to friends, family, and sometimes entire communities.

I went searching for a solution in the WordPress ecosystem. What I found was… underwhelming. Most plugins either didn’t work, had terrible UX, or were complicated to configure. The opportunity was clear.

Building the Solution

Session Manager was born from a simple idea: make session control as intuitive as possible while giving site owners the power they need.

For the Admin

A clean dashboard shows every active session at a glance. Search by user, browser, IP, or operating system. Spot the accounts with suspiciously high login counts instantly. One click terminates any session.

For the Site Owner

Set a sitewide limit for parallel logins and the problem is solved. But the real magic is in the premium tier: per-user limits that turn session slots into a monetizable feature. Suddenly “buy extra login slots for your team” becomes a revenue stream.

For the End User

Nobody wants angry users locked out of their accounts. Session Manager includes an AJAX-powered frontend table where users manage their own sessions. Email notifications alert them when someone new logs in with their credentials.

Developer Experience

Building for developers was a priority from day one. The plugin exposes a filter-based API that makes custom integrations trivial:

// Check if current user is within session limit
if (!apply_filters("is_within_session_limit", true, wp_get_current_user())) {
    wp_die("Session limit reached. Please log out from another device.");
}

// Whitelist administrators and editors
add_filter("is_within_session_limit", function($within, $user) {
    $allowed_roles = ['editor', 'administrator'];
    if (array_intersect($allowed_roles, $user->roles)) {
        return true;
    }
    return $within;
}, 99, 2);

Technical Foundation

This project wouldn’t exist without the development patterns I’ve refined over years of WordPress development. The codebase leverages my WordPress Plugin Boilerplate for structure and my WP Secure Actions library for secure AJAX handling.

Key technical decisions:

• REST API first - All session management happens through custom endpoints, making the frontend highly responsive
• Minimal database footprint - Hooks into WordPress’s existing session infrastructure rather than creating new tables
• Freemius integration - Handles licensing, updates, and analytics without reinventing the wheel

The Impact

Session Manager now protects thousands of WordPress sites. The feedback that makes it worthwhile comes from site owners who finally have visibility into who’s actually using their platform.