Loggedin
by Fahad Mahmood
Limits how many active sessions or devices a single WordPress account can use at once.
This link may earn us a commission. It never changes our rating.
What Loggedin does
Limits how many active sessions or devices a single WordPress account can use at once.
It sits in the security part of a WordPress stack and is sold by Fahad Mahmood on a free basis. We recommend it in our security guides because it does that one job well without asking you to rebuild the rest of the site around it.
Every plugin adds work to a page request, so treat this as a decision with a cost. Record a speed test before you install it and run the same test afterwards, on the same page, so you know exactly what it charged you.
Real user ratings
Score
4.9/5
Reviews
111
Active installs
8,000+
Downloads
172K
Latest version
3.2.0
Last updated
2026-08-30
These figures come straight from the public WordPress.org plugin directory API for version 3.2.0, not from us. Check them yourself on the WordPress.org listing. Our own editorial score is 4.4/5.
Where Loggedin ranks elsewhere
Loggedin does not appear in the published "best of" lists we track from WPBeginner, TechRadar, Kinsta, Themeisle and similar sites. That is not a mark against it - those roundups are short and skew towards the biggest names.
What changed in the latest version
- Improve: Faster settings reads - the plugin's settings are now built once per request instead of on every read, cutting repeat work on each login and admin page load.
- Improve: Loggedin is now published under the Foxe Labs brand. Nothing about how the plugin works has changed.
- Improve: Updated every link in the plugin to the new foxelabs.com product pages and docs.foxelabs.com documentation.
- Improve: Removed the leftover Loggedin section on Settings → General. It only pointed at the real settings page and has been redundant since 2.0 - settings live under Users → Loggedin.
- Improve: Dropped the manual translation loading call - WordPress has loaded translations for wordpress.org plugins by itself since 4.6, so the call was redundant.
- Compat: Tested with WordPress 7.1.
- New: WP-CLI support - manage Loggedin from the command line with wp loggedin sessions (list, count, destroy) and wp loggedin settings (list, get, set). Run wp help loggedin for the full reference.
- New: wp loggedin sessions destroy <user> --token=<hash> signs a user out of a single device instead of all of them.
- New: loggedin_cli_init action so add-ons can register their own subcommands under the wp loggedin namespace.
- New: loggedin_destroy_session action fired when an individual session is destroyed.
- Improve: Renamed to "Loggedin - Session Manager, Limit Concurrent Logins & Force Logout" to reflect the plugin's broader scope. Nothing about the concurrent-login limiting has changed - same settings, same behaviour, same plugin.
- Improve: The CLI refuses to write a setting the sanitizer would reject, so a typo can no longer silently reset your login logic to the default.
- Improve: CLI commands are only loaded on WP-CLI requests - a normal page load doesn't pay for them.
- New: Review-request notice restored, powered by the duckdev/wp-review-notice library and scoped to the Loggedin settings screen with a 7-day delay.
- Improve: Legacy review-notice state migrated to the new storage keys so users who already dismissed the prompt stay dismissed.
- Improve: Admin notices now render inside the plugin's centered page column instead of above the header.
- Fix: Left-hand gap between the plugin header and the admin sidebar caused by WordPress's default #wpcontent padding.
Release notes are the developer's own words, published on WordPress.org. Read the full changelog
Pros and cons
- Stops shared account credentials
- Free with no licence to renew
- Actively maintained and used on production sites we test
- Blunt limits can lock out real users
- Support is community-led rather than guaranteed
How to use it
- 1Take a full backup before enabling any blocking feature.
- 2Turn on login protection and two-factor for administrator accounts first.
- 3Schedule scans outside peak hours to protect response times.
- 4Set alerts to a monitored inbox, not the default admin address.
- 5Re-run the speed test so you know what the protection costs you.
How it compares
Other security plugins we recommend, with their rating and pricing model.
| Plugin | Our rating | WordPress.org | Pricing | Best for |
|---|---|---|---|---|
| Loggedin | 4.4 | 4.9 (111) | Free | Stops shared account credentials |
| Akismet | 4.7 | 4.7 (1,186) | Freemium | Catches almost all comment spam with no tuning |
| Antispam Bee | 4.8 | 4.8 (226) | Free | Privacy friendly spam filtering with no account |
| Duo | 4.2 | 4 (1) | Freemium | Central policy control for teams |
| Jetpack Protect | 4.3 | 4.6 (123) | Freemium | Free vulnerability alerts |
| Limit Login Attempts Reloaded | 4.8 | 4.8 (1,483) | Freemium | Big protection for almost no overhead |
Guides that cover Loggedin
Alternatives
Other security plugins
Akismet
Automattic
Comment and form spam filtering run through Automattic's hosted service, checked against a global spam corpus.
1,186 reviews · 406.0M downloads · v5.7.2
Antispam Bee
pluginkollektiv
Blocks comment spam locally with no external service and no personal data leaving your server.
226 reviews · 13.0M downloads · v2.11.13
Duo
Cisco Duo
Enterprise two-factor from Cisco Duo, with push approval and device policy controls.
1 reviews · 20K downloads · v1.2.1