When you sell or protect content with Restrict for WordPress, shared passwords are your worst enemy: one paying member can hand their credentials to friends, and suddenly everyone gets in for free. While you cannot stop people from sharing a password, you can limit concurrent logins in WordPress so a single account cannot be used from many places at the same time. This guide shows you how to set that up alongside Restrict.
Why limit the number of logins?
If you are restricting the content on your website with the Restrict WordPress plugin, you most likely don’t want anyone who isn’t intended to access that content to get in. That is why users on your website must be logged in with their usernames and passwords to access restricted content, regardless of which restriction criteria you use.
Unfortunately, there will always be people who try to "beat the system" by sharing their login credentials with third parties — and there is nothing you can do to prevent the sharing itself. What you can do is limit the number of allowed concurrent logins for your registered users, so shared credentials become far less useful.
Prerequisites
- Restrict for WordPress installed and activated, with some content already restricted to logged-in users, roles or customers.
- The free Loggedin – Limit Active Logins plugin from WordPress.org (or a similar plugin — the steps below refer to this one).
How to limit concurrent logins in WordPress
- Install and activate the Loggedin plugin, just like any other WordPress plugin.
- Head to Settings → General in your WordPress admin.
- Scroll all the way down, where you will find these settings:
Understanding the settings
The first setting, labeled Maximum Active Logins, will — as you would expect — allow you to set the number of allowed active logins per user account.
Below that, you can affect the logic of the login. If you set it to Allow, a user will still be able to log in even when the allowed number of logins has been reached, but the other currently logged-in sessions for that account will be logged out. If you select Block instead, once the number of allowed logins is reached, every further login attempt on that account is simply blocked.
Lastly, the Force Logout option allows you to force-log-out a specific user by entering their user ID — useful when you spot an account that is clearly being abused.
Use case: paid, time-sensitive content
Limiting logins comes in particularly handy when you offer time-sensitive restricted content. For example, imagine you are streaming an online course on your website and have restricted access only to users who paid for it. With a login limit in place, you effectively block multiple people from watching simultaneously through the same purchased account.
This pairs naturally with Restrict’s e-commerce integrations: sell access through WooCommerce or Easy Digital Downloads, restrict the content to customers, and let the login limit protect the value of each purchase. For a complete walkthrough of such a setup, see our guide on selling online courses on your website.
Tips
- Pick a realistic limit. Legitimate users often switch between a phone, a laptop and a tablet. A limit of 2–3 active logins usually stops abuse without frustrating honest members; a limit of 1 is strict and best reserved for high-value live content.
- Choose Allow vs Block deliberately. Allow is friendlier — the paying customer can always get in, and freeloading sessions get kicked out. Block is stricter, but can lock out the real owner if they forgot to log out elsewhere.
- Tell your users. Mention the login limit in your terms or FAQ so members understand why an old session was ended.