FluentAuth – The Ultimate Authorization & Security Plugin for WordPress vs Loggedin – Session Manager, Limit Concurrent Logins & Force Logout

Boost Your Website’s Security with Login/Signup Security, Two-Factor Email Authentication, Login/Logout Redirects, Social Logins, Detailed Audit Logs, and More. FluentAuth is the lightest and blazing fast security plugin for WordPress. Highlighted Features Two-Factor Authentication for Login Magic Login via Email Social Login / Register Limit Login Attempts Dynamic Login Redirects Detailed Audit Logs Core Security Enhancement Security Email Notifications Super Fast Solution Restrict /wp-admin for low level user roles What’s new in version 2.0 🚀 Two-Factor Authentication for Login Ensure secure access to your admin panel with Two-Factor Login via email for high-level user roles like Administrator / Editor. Even if a password gets compromised, only the right person will be able to log in with the additional authentication step. 🚀 Magic Login via Email Simplify the login process for end users like customers and subscribers. No more password resets or forgotten passwords that cause users to leave your site. With our improved flow and features, users can log in to your site simply by typing their username or email address and clicking on a secure one-time use link sent to their email. 🚀 Social Login / Register Allow users to log in to your site with their GitHub, Facebook or Google accounts. This feature is lightweight and easy to enable. 🚀 Limit Login Attempts Protect your site against brute force attacks by blocking excessive login attempts. Our simple yet powerful tools also improve site security and performance, and allow for customizable lockout timings. 🚀 Dynamic Login Redirects Easily redirect users to specific pages after they log in or log out. Our drag-and-drop builder lets you customize the login and logout flow for different types of businesses. 🚀 Detailed Audit Logs Track exactly when users log in to your site and via which method (normal login form, magic URL, or social media) with our powerful audit logs. 🚀 Core Security Enhancement XML-RPC is a common target for WordPress attacks, but most sites don’t actually need it. This plugin enables you to disable XML-RPC, Remote Application Login, and protect the wp-users listing for REST API for enhanced security. 🚀 Security Email Notifications As a business owner, it’s important to know when high-level users like administrators, editors, and authors log in to your site, or if someone unauthorized is trying to log in. Our plugin includes email notifications to alert you of these events. 🚀 Super Fast Solution We’ve built this plugin to be super-fast and simple yet powerful, using the latest technologies like WordPress REST-API, VueJS V3, Vue-Router, and Element-Plus for UI building. We also use custom database tables to store audit logs, so they don’t interfere with your default WordPress database tables. 🚀 Restrict /wp-admin for low level user roles If you want to restrict /wp-admin access for subscribers or other low level user roles then you can easily enable that and select the user roles that you want to restrict /wp-admin access. 🚀 Customize WordPress Signup Emails Customize the WordPress default signup emails with your own branding and content. This feature allows you to create a more personalized experience for your users, enhancing their engagement with your site. 🚀 Custom Login/Signup Shortcodes Create custom login and signup forms using shortcodes. This feature allows you to easily integrate login and signup forms into your pages or posts, providing a seamless user experience. 🚀 Disable Admin Email Notifications on User Signup Disable the default WordPress admin email notifications that are sent when a new user signs up. This feature helps you manage your email notifications more effectively, reducing clutter in your inbox. 🚀 Scan WordPress Core File Changes FluentAuth includes a feature to scan WordPress core files for changes, helping you identify any unauthorized modifications. This is crucial for maintaining the integrity of your WordPress installation and ensuring that your site remains secure. Why FluentAuth? To improve the security and user experience of a WordPress website, the default authentication system may need to be enhanced with additional plugins. One common issue that WordPress site owners face is their site getting hacked. This is often due to hackers using brute-force attacks to guess passwords and gain access to the admin panel, leading to site takeover. Additionally, the use of common passwords on multiple sites can put all of them at risk if one password is compromised. Using multiple security plugins can be detrimental to the performance of a WordPress website. These plugins, which are often bloated, intercept every WordPress request and run it through a large number of unnecessary rules, resulting in increased server resource usage and slower site performance. To avoid this issue, consider using a comprehensive security solution that offers multiple features in one package, instead of relying on multiple individual plugins. This will help save server resources and improve the overall performance of your website. To Solve these issues, we decided to build FluentAuth and made it free. Replace Multiple Plugins with FluentAuth FluentAuth has been designed to provide light-weight security solution while adding better UX and performance of your site. If you use FluentAuth then you don’t need the following plugins For Login Limit and ban brute force attacks Limit Login Attempts Reloaded WPS Limit Login For Login & Logout Redirections LoginWP (Formerly Peter’s Login Redirect) Sky Login Redirect WP Login and Logout Redirect For Login & Logout Redirections LoginWP (Formerly Peter’s Login Redirect) Sky Login Redirect WP Login and Logout Redirect For Hide Admin Bar and Access Restriction Hide Admin Bar Hide Admin Bar Based on User Roles Auto Hide Admin Bar Hide Admin Bar from Non-Admins User Guides Getting Started with FluentAuth Login / Logout Redirects Register/Login Shortcodes in FluentAuth Configure Login with GitHub Configure Login with Google Other Plugins By The Same Team FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler FluentCRM – Email Marketing, Newsletter, Email Automation and CRM Plugin for WordPress Fluent Forms – Fastest WordPress Form Builder Plugin Ninja Tables – Best WP DataTables Plugin for WordPress Ninja Charts – Best WP Charts Plugin for WordPress WPPayForm – Stripe Payments Plugin for WordPress Mautic Integration For Fluent Forms Fluent Forms PDF – PDF Entries for Fluent Forms FluentSMTP – WordPress Mail SMTP, SES, SendGrid, MailGun Plugin CONTRIBUTE If you want to contribute to this project or just report a bug, you are more than welcome. Please check repository from Github.

Loggedin is a session manager for WordPress — it gives you control over the login sessions your users hold, and the tools to end them when you need to. At its core, Loggedin caps the number of simultaneous WordPress sessions a user account is allowed to hold. When the cap is reached, you choose what happens next — log out the oldest device, log out every other device, or block the new login outright. It’s the lightweight, no-bloat way to stop account sharing on membership sites, LMS courses, paid communities, and any WordPress install where one paid account shouldn’t be open on five devices at once. The plugin hooks straight into WordPress’s standard authentication pipeline and uses the native WP_Session_Tokens API, so it works on every host, with every theme, and alongside every login plugin you might already run. No cron jobs, no background polling, no third-party services. How it works A “session” in WordPress is the authenticated token created the moment a user logs in — one per browser, per device. Two browsers on the same laptop count as two sessions; a phone and a desktop count as two. Closing a tab does not end a session — the token lives server-side until the user explicitly signs out or another login displaces it. Loggedin watches every login attempt: Counts the user’s current active sessions. Compares that count to the limit you’ve configured. Applies the rule you’ve picked — silently make room for the new login, or reject the new login with an error on wp-login. There’s a one-click Force Logout panel in the admin to clear every session for a specific user when someone’s locked out by the cap and can’t reach their other devices. Identify the user by ID, email, or username — all three work. Who it’s for Membership sites — MemberPress, Paid Memberships Pro, Restrict Content Pro, WooCommerce Memberships, etc. Stop one paid account from being shared across a household, a classroom, or a Discord server. Online courses & LMS — LearnDash, LifterLMS, TutorLMS, Sensei. Make sure the seat someone paid for is actually used by that someone. Subscription stores — WooCommerce Subscriptions, Easy Digital Downloads recurring. Keep subscriber counts honest. Corporate intranets & client portals — Enforce a one-device-at-a-time policy for staff or client accounts. BuddyPress / BuddyBoss communities — Reduce ban-evasion and duplicate-account abuse. Compliance-driven sites — Healthcare, finance, education installs where audit policy requires a per-account session cap. Features Session management from the dashboard — Inspect and end user sessions from Users → Loggedin, or from WP-CLI. Add the Active Sessions add-on for a live, sortable view of every signed-in user and device. Global concurrent-login limit — Pick any number from 1 upwards as the per-user cap. Three built-in modes — Logout Oldest (kick the user’s oldest device, keep the rest), Logout All (the new login becomes the only active session), or Block New (reject the login and show an error on wp-login). Admin Force Logout — Type a user ID, email, or username and clear every active session for that user in one click. Works with any session storage — Uses the standard WP_Session_Tokens API. Stock WordPress, Redis, Memcached — all supported (the Logout Oldest mode needs the default user-meta storage; the other modes work everywhere). Customizable error message — Override the message shown when a login is blocked, via a single filter. WP-CLI support — Inspect and destroy user sessions and read or write settings from the command line: wp loggedin sessions list , wp loggedin sessions destroy , wp loggedin settings set maximum 3. Ideal for bulk operations, deploy scripts and headless installs. Built for developers — Every decision passes through documented PHP hooks and filters. Override the cap per user / role / capability, exempt service accounts, audit force-logouts, or splice the plugin into your own auth pipeline. Full hook reference in the developer docs. Lightweight — No cron, no background polling, no remote calls. The whole plugin runs at the moment a login happens. Translation-ready — Loaded with the WordPress i18n APIs; contribute translations on WordPress.org. 📦 Add-ons Extend Loggedin with these official add-ons: Active Sessions — See exactly who’s signed in right now, drill into each device per user, and sign out a single session — or every session — in one click. Auto Logout — Sign users out automatically after a period of inactivity. Set an idle timeout, warn users before the session ends, and keep unattended machines from staying signed in. Limit Per User — Override the global session cap for an individual user account directly from their WordPress profile. Perfect for tiered access or trusted-staff exemptions. Limit Per Role — Set a different concurrent-session cap per WordPress role. Give administrators more headroom while keeping subscribers tight, or vice versa. Real-time Logout — Detect logouts in near-real-time. When Loggedin terminates a session, the user’s other open tabs reload to wp-login automatically — no waiting for the next page click. 📚 Documentation Getting started General settings Force Logout (Manage Sessions) WP-CLI commands Add-ons overview Developer docs — hooks, filters, REST 🐛 Bug reports Found a bug? File it on the Loggedin GitHub repository. GitHub is for bug reports and development-related issues only. For end-user support, please use the WordPress.org support forums.