Monitor WordPress User Sessions & Force Logout (Logify PRO)

Need to know exactly who is logged into your WordPress site right now — and cut off a session you don't trust? The User Sessions screen in Logify PRO is a live ledger of every active, idle, expired, and revoked login, with per-user filtering, bulk delete, and one-click Force Logout to revoke any session instantly. It lives at Logify → User Sessions and was introduced in Logify 1.6.0.

What is the User Sessions screen?

The User Sessions screen is a live dashboard of everyone who is currently logged into your WordPress site, plus a history of past logins. It shows active, idle, expired, and revoked sessions across every user account, and lets you end any of them without changing the user's password.

Three summary cards sit at the top of the page:

• Active Sessions — users who made a request within the last 5 minutes.
• Loaded Sessions — the number of session records currently shown, based on your filter.
• Expired Sessions — idle, ended, or revoked sessions listed below.

Why monitor logged-in sessions?

Several people with dashboard access at once is a security exposure — a laptop left unlocked, a login from an unexpected country, or a shared account no one logged out of. Monitoring sessions lets you:

• See who is online — tell active team members apart from idle logged-in users.
• Spot unfamiliar access — check the device, browser, IP address, and country of every session.
• Force logout instantly — revoke any user or single session with one click.
• Filter by user — review one team member's session history without scrolling past everyone else's.

How to monitor and end user sessions

Step 1: Open the User Sessions screen

In your WordPress dashboard sidebar, go to Logify → User Sessions.

Step 2: Read the session table

Each row is one login session. The table lists these columns:

• Username — the account name and user ID.
• Role — the user's assigned WordPress role (for example Administrator).
• Login — the date and time the session started.
• Last Activity — when the user last made a request.
• Duration — how long the session has been open.
• Browser — the browser reported by the session (for example Chrome).
• Device — the operating system or device (for example Windows).
• IP / Country — the IP address and resolved country for the login.
• Status — one of ACTIVE (a request within the last 5 minutes), IDLE (logged in but not recently active), or EXPIRED / REVOKED (ended or forcibly logged out).
• Actions — the Force Logout button for active or idle sessions.

Step 3: Filter sessions by user

To narrow the ledger to one account instead of everyone:

1. Open the All Users dropdown above the table.
2. Select the user account you want to inspect.
3. Click Filter.

Step 4: Force logout a user

• A single session: find the row and click Force Logout under the Actions column. The session is revoked immediately and the user must log in again.
• Multiple sessions at once:
  1. Check the boxes beside the sessions you want to end.
  2. Choose Force Logout (or Delete selected) from the Bulk actions dropdown.
  3. Click Apply.

Force Logout is recorded as an activity in your logs, so revoking a session is itself auditable.

Step 5: Delete expired or revoked sessions

Old records don't need to stay on screen. To clear them:

1. Check the boxes beside any EXPIRED or REVOKED rows. (Active sessions can't be deleted — force logout the user first.)
2. Choose Delete selected from the Bulk actions dropdown.
3. Click Apply.

When does an idle session expire?

A session is marked ACTIVE for 5 minutes after the last request, then shown as IDLE. Logify treats a session as expired after a longer idle window (one day by default). Developers can change that window with the kc_lf_idle_session_expiration_window filter — see Hooks and Filters.

Conclusion

The Logify PRO User Sessions screen turns "who is logged in right now?" into a single screen you can act on — filter to one user, spot an unfamiliar IP or country, and revoke a session in one click. To follow what a specific user did after you spot them, open the Activity Timeline; for the full record of every change on your site, see who changed what on your website.

FAQs

Is the User Sessions screen free or PRO?

The User Sessions screen and Force Logout are Logify PRO features, added in version 1.6.0. The free plugin still records login and logout events in the Activity Logs, but the live session ledger — with active/idle status, per-user filtering, bulk delete, and one-click session revocation — requires Logify PRO.

Does Force Logout change the user's password?

No. Force Logout revokes the selected session token so that device is signed out and must log in again; it does not reset or change the account password. If you suspect the account is compromised, force logout to cut off access immediately, then reset the password separately from the WordPress Users screen.

What is the difference between an idle and an expired session?

A session is ACTIVE for 5 minutes after the user's last request, then shown as IDLE while the login is still valid but inactive. Once the idle period passes the configured window (one day by default), the session is treated as EXPIRED. A session you revoke manually is marked REVOKED.

Can I see sessions for just one user?

Yes. Use the All Users dropdown above the session table, select the account you want, and click Filter. The table then shows only that user's sessions, which makes it easy to audit one team member's logins without scrolling past everyone else's records.

Can I automatically log out idle sessions sooner?

The point at which Logify treats an idle session as expired is controlled by the kc_lf_idle_session_expiration_window filter, which defaults to one day. A developer can shorten it in your theme or a custom plugin. There is no built-in setting for this window in the Logify admin screens.