See Active Access, Not Just the Last Login Date
Knowing that a user signed in yesterday does not tell you which browser sessions remain active today. An account may be open on an office workstation, a laptop, and a browser that the user no longer needs. Login Session Manager makes those active sessions visible within the WordPress account-management workflow. Instead of treating every successful login as an event that disappears into the past, you can review the access that remains and decide whether it should continue.
The module exposes this information in several practical places: the user's profile, the Edit User screen, a Users-table column, and a site-wide searchable overview for authorized operators. WooCommerce users can also access a sessions box in My Account. These are views of WordPress's native session tokens, not a new device-fingerprinting system. They help you understand and manage authenticated sessions without claiming that every token uniquely identifies a physical device or person.
Revoke Sessions Without Rebuilding User Accounts
When a particular session should no longer have access, Login Session Manager lets an authorized user end that session directly. A user-wide action can revoke the sessions belonging to one account, while a separate site-wide action is available to suitably privileged administrators. That gives you a range of responses: remove one unnecessary login, sign a user out across their sessions, or deliberately end sessions across the site when the situation calls for it.
Session management respects administrative boundaries. Operators can manage users at or below their permitted capability level, and the site-wide action requires administrator-level permission, or super-administrator permission on Multisite. The module is therefore not a way for an ordinary account to sign out a more privileged administrator. It also does not reset passwords, remove users, or investigate the cause of suspicious access by itself; revocation addresses the existing session, while account changes remain separate decisions.
Set Concurrent Login Limits That Match Each Role
A single session policy rarely fits everyone on a WordPress website. An editor may need a desktop browser and a laptop, while a subscriber account may be intended for one active session. Login Session Manager lets you define role-specific maximums instead of imposing the same restriction on all users. Each role can allow up to 50 concurrent sessions, and a value of 0 means unlimited, not that the account is prevented from signing in.
The initial limits are unlimited for administrators, three for editors, two for authors, and one for contributors and subscribers. These are editable defaults, and custom roles can be added to the configuration. Roles can also be excluded, but a role cannot simultaneously be listed as both limited and excluded. This makes the policy explicit: you choose which accounts need a concurrency restriction, how restrictive it should be, and which roles should remain outside it.
Choose Between Ending Older Sessions and Blocking New Logins
When another login would exceed the allowed number of sessions, WP PowerSuite provides two different responses. Log Out Oldest is the default: it removes the oldest tokens so the new session can fit within the limit. An optional notice explains that an older session was ended. This suits workflows where a user should be able to move to a new browser without first returning to another device simply to sign out.
Block Login takes the opposite approach. The newly created session is destroyed, the user is logged out of that new session, and the browser returns to the login screen with a blocked-login notice. Existing sessions remain the ones occupying the permitted slots. Enforcement runs during supported login and cookie-setting events, with an additional periodic user check whose default interval is 10 minutes. That periodic check is configurable from 1 to 60 minutes; it is not a continuously running background monitor.
Put Session Controls Where Users Already Manage Access
Session visibility is useful only when people can find it. Login Session Manager adds an Active Sessions box to Profile and Edit User, and the Users-table count links to the relevant profile section. An admin-bar item appears when a user has at least two sessions, giving them a reminder that more than one login is active. These controls keep session management close to ordinary account administration rather than requiring a separate security dashboard for every task.
The WooCommerce My Account dashboard provides another access point for supported customer-facing workflows. Administrators can choose whether profile, Users-column, and admin-bar surfaces appear, and can hide IP or user-agent details in the interface. Hiding those fields is a display setting, not a promise that WordPress stops maintaining its underlying session information. The module continues to manage native tokens, so the interface and the account's actual authentication state stay connected.
Keep Support Access Separate From Normal Concurrency Limits
A temporary support invitation and an impersonated troubleshooting session have different lifecycles from an ordinary password login. Automatically removing one of those sessions merely because a user's standard role limit has been reached could interrupt the support task. Login Session Manager therefore excludes Temporary Login and Login as User sessions from its concurrency-limit enforcement, and relevant rows can carry badges identifying those session types.
Those exceptions do not make support sessions permanent or remove the controls belonging to their own modules. Temporary Login continues to handle invitations and their restrictions, while Login as User handles impersonation and returning to the original operator. Session Manager's responsibility is narrower: it avoids applying ordinary concurrency limits to those special workflows. This separation is particularly useful for agencies that need to investigate an account without making normal session enforcement terminate their support access unexpectedly.
