---
title: Session policies
description: Limit how many devices a user can log in on, and log out sessions that nobody uses.
url: "https://docs.prefixwp.com/docs/pastmark/pastmark-pro/session-policies/"
updated: "2026-11-10"
category: Pastmark Pro
---

# Session policies

A **session policy** limits how many devices one user can use. It can also log out sessions that nobody uses. This is a feature of **Pastmark Pro**.

Go to `User Activity → Settings → Sessions → Policies`.

[![The Policies tab with the default rule (5 sessions, end the oldest session, idle timeout 8 hours) and a rule for the Contributor role (1 session, block the new login, idle timeout 1 hour)](http://localhost/wp-content/uploads/2026/11/pastmark-pro-session-policies.webp)](http://localhost/wp-content/uploads/2026/11/pastmark-pro-session-policies.webp)
User Activity → Settings → Sessions → Policies.

## The settings

| Setting | Values | What it does |
| --- | --- | --- |
| **Max concurrent sessions** | **Unlimited**, or 1 to 10 | How many devices a user can be logged in on at the same time. |
| **When the limit is reached** | **End the oldest session** (default) or **Block the new login** | What happens when a user logs in over the limit. |
| **Idle timeout** | **Off**, 15 minutes, 30 minutes, 1 hour, 2 hours, 4 hours, 8 hours or 24 hours | A session that nobody uses for this time is ended. |

## Set a policy

1. Go to `User Activity → Settings → Sessions` and click **Policies**.
2. Under **Default for all roles**, choose the three settings. This rule is for everybody.
3. To make a different rule for one role, choose the role under **Add a rule for a role...** and click **Add**. Then choose the settings for that role. Click **Remove override** to delete the rule of a role.
4. Click **Save policies**.

Nothing is enforced until you save a policy.

## Which rule is used

- A rule of a role **replaces** the default rule for that role.
- A user with **several roles** gets the strictest rule of these roles.
- **Administrators are never blocked.** If you choose **Block the new login**, an administrator at the limit still logs in. Pastmark ends the oldest session instead.
- If a save would end **your own** session, Pastmark refuses it.
- Application passwords and WP-CLI are not sessions. They are never counted and never blocked.

## Block the new login

With **Block the new login**, the user cannot log in on a new device. The login screen shows this message:

[![The WordPress login screen with the error: this account is already logged in on the maximum of 1 device(s). Log out there first, or ask an administrator to end a session](http://localhost/wp-content/uploads/2026/11/pastmark-pro-login-blocked.webp)](http://localhost/wp-content/uploads/2026/11/pastmark-pro-login-blocked.webp)
The message on the login screen.

The user must log out on the other device first. Or you end a session on the [Sessions page](/docs/pastmark/pastmark-pro/manage-login-sessions/).

## Idle timeout

Pastmark Pro ends a session that was idle for too long when the next request comes in.

- Inside `wp-admin`, the user goes to the login screen.
- On the public site, the visitor simply becomes logged out.

## What Pastmark logs

These events are in the **Sessions** group in `User Activity → Events`. They are on by default.

| Event | Severity | When |
| --- | --- | --- |
| **Oldest Session Ended** | Info | A login passed the limit, so the oldest session was ended. |
| **Login Blocked** | Warning | A login was refused because the user is at the limit. Example: `Login blocked for "support": already at the limit of 1 sessions.` |
| **Idle Timeout** | Info | A session ended after the idle timeout. |
| **Policies Changed** | Warning | Someone changed the policies. The event shows the values before and after. |

## How Pastmark knows that a session is idle

Pastmark Pro saves the time of the last activity of each logged-in session. It writes this at most **once a minute**. The time is saved inside the session itself. It is harmless. It stays after you uninstall Pastmark Pro, and it disappears when the session ends.

On a site with thousands of users who are logged in at the same time, keep the one-minute write in mind. If two writes happen at the same moment, WordPress can lose one. Then the time fixes itself within a minute.

When you deactivate Pastmark Pro, the policies stop working at once.

## Examples

| You want to... | Default rule | Rule for a role |
| --- | --- | --- |
| Stop people from sharing one account | Max 1, **Block the new login** | None |
| Log out forgotten sessions | Idle timeout 8 hours | None |
| Strict rules for editors only | Unlimited, idle timeout Off | Editor: max 2, **End the oldest session**, idle timeout 2 hours |

## Next steps

- [See and end login sessions](/docs/pastmark/pastmark-pro/manage-login-sessions/)
- [New-login alerts](/docs/pastmark/pastmark-pro/new-login-alerts/)