Session policies

A session policy limits how many devices one user can use. It can also log out sessions that nobody uses. This is a feature of Pastmark Pro.

Go to User Activity → Settings → Sessions → Policies.

The settings #

Setting	Values	What it does
Max concurrent sessions	Unlimited, or 1 to 10	How many devices a user can be logged in on at the same time.
When the limit is reached	End the oldest session (default) or Block the new login	What happens when a user logs in over the limit.
Idle timeout	Off, 15 minutes, 30 minutes, 1 hour, 2 hours, 4 hours, 8 hours or 24 hours	A session that nobody uses for this time is ended.

Set a policy #

1. Go to User Activity → Settings → Sessions and click Policies.
2. Under Default for all roles, choose the three settings. This rule is for everybody.
3. To make a different rule for one role, choose the role under Add a rule for a role… and click Add. Then choose the settings for that role. Click Remove override to delete the rule of a role.
4. Click Save policies.

Nothing is enforced until you save a policy.

Which rule is used #

• A rule of a role replaces the default rule for that role.
• A user with several roles gets the strictest rule of these roles.
• Administrators are never blocked. If you choose Block the new login, an administrator at the limit still logs in. Pastmark ends the oldest session instead.
• If a save would end your own session, Pastmark refuses it.
• Application passwords and WP-CLI are not sessions. They are never counted and never blocked.

Block the new login #

With Block the new login, the user cannot log in on a new device. The login screen shows this message:

The user must log out on the other device first. Or you end a session on the Sessions page.

Idle timeout #

Pastmark Pro ends a session that was idle for too long when the next request comes in.

• Inside wp-admin, the user goes to the login screen.
• On the public site, the visitor simply becomes logged out.

What Pastmark logs #

These events are in the Sessions group in User Activity → Events. They are on by default.

Event	Severity	When
Oldest Session Ended	Info	A login passed the limit, so the oldest session was ended.
Login Blocked	Warning	A login was refused because the user is at the limit. Example: Login blocked for "support": already at the limit of 1 sessions.
Idle Timeout	Info	A session ended after the idle timeout.
Policies Changed	Warning	Someone changed the policies. The event shows the values before and after.

How Pastmark knows that a session is idle #

Pastmark Pro saves the time of the last activity of each logged-in session. It writes this at most once a minute. The time is saved inside the session itself. It is harmless. It stays after you uninstall Pastmark Pro, and it disappears when the session ends.

When you deactivate Pastmark Pro, the policies stop working at once.

Examples #

You want to…	Default rule	Rule for a role
Stop people from sharing one account	Max 1, Block the new login	None
Log out forgotten sessions	Idle timeout 8 hours	None
Strict rules for editors only	Unlimited, idle timeout Off	Editor: max 2, End the oldest session, idle timeout 2 hours

Next steps #

• See and end login sessions
• New-login alerts