User Sessions – Who’s logged into my WordPress?

Ever wondered who’s currently logged in to your WordPress site?

If you’re the admin of a WordPress site, then this question has definitely crossed your mind at least once (a day)!

By default, WordPress offers absolutely no way to know this.

The Shield Security let’s you see this and more.

Read on to discover how you can finally get a view on your WordPress users.

How do WordPress user sessions work?

WordPress does not use PHP sessions and does not maintain information (states) from 1 page load to the next – it is completely stateless.

This means that WordPress only cares that each time you load a page, you can verify that you are authenticated with it.

How does it do that?

With Cookies.  When you log into WordPress, it will set a number of cookies on your browser that are checked on each page load.

What’s the advantage of having no WordPress user sessions?

Simplicity, and compatibility with more web hosting environments.

If your users can set cookies, then effectively you can manage WordPress user authentication.

What’s the disadvantage of having no user sessions in WordPress?

There’s a few.  The primary being that since WordPress is stateless, it never knows anything about what has come before.

In this way there is no way to know, by default, who is logged-in, and who is actively using the site right now.

Furthermore, if I can “sniff” your WordPress cookies I can put them on my machine and I’ll be authenticated with your site too.  By default WordPress cannot offset these risks.

Why would you want better control over WordPress User Sessions?

If you want to know who is logged-in, and from where, deeper user sessions management is the only way.

If you want to forcefully log-out certain users for whatever reason, with user session management you can do so without affecting other logged-in users.  For example:

• You want to log-out idle users (after a certain length of time that you decide)
• You want to restrict a user session to an IP address (in this way you can’t just sniff cookies and apply them to your browser – unless you’re in the same location)

Let’s say you’re an administrator of a site, and you see that somehow, some way, someone else is logged into the site under your administrator username in another location – you can immediately take action against this.  Without being able to see currently active sessions, you are blind.

User sessions simply give you a view on to who is on your site and where they are.  Until now, this is not possible with WordPress.

How do the Shield Security user sessions work?

As of version 3.0, the Shield Security now creates simple WordPress user sessions.

It does not replace the WordPress user authentication system, but rather augments it.  In this way, we remain 100% compatible with past, current, and future WordPress releases.

When you enable the User Management feature for the first time, you’ll be logged out of WordPress.

This is because you’ve activated the Shield’s user sessions management and it’ll immediately check whether you have an active session in the database.

If it can’t find it, it logs you out – you immediately experience the effects of the user sessions managements.

Once you’re logged-in, however, each time you access the site, it’ll lookup your sessions against the database – to track your session, it places a unique cookie with your session ID. This is matches against your WordPress username and determines the validity of your session.

You can also optionally lock sessions to IP addresses for extra session hardening.

How can I see who is actively logged in to my WordPress site?

On the ‘Users’ section of the plugin, you can view currently active sessions.

It outlines:

• the time they logged into this session
• their last activity time
• the IP address from which they’re accessing the site (which links to an IP Whois)
• if the user is Security Admin or not

Future Features of the User Session Management system

This is just the beginning of the user management system within the Shield Security.

We plan to release more features, including:

• forcefully log out individual users
• forcefully log out all active users
• lock-out certain users based on failed login attempts either permanently or temporarily
• … ?

What do you want to see?

If there is a feature that you’d like to see added to user session management, please let us know in the comments below, or contact us directly in our support centre.

We’ve built the Shield Security plugin for WordPress for you… and we’d love to hear what you think, what works, and what doesn’t.

So please tell us! 🙂