Your phone went missing on the train, and the WordPress app or browser on it was still signed in to your site. Or a laptop at the office, the one everybody borrows, has your dashboard open in a tab. Changing the password feels like the obvious move, but you also want to be sure that whoever has that device is thrown out right now.
WordPress can do this. You can log out all sessions in WordPress for your own account in two clicks, end another user’s logins from their profile, or, with more care, sign out every single person at once. Each method is below, along with the one thing core WordPress does not offer: a screen showing who is logged in right now.
How WordPress keeps people logged in
When someone logs in, WordPress stores a small record of that login, called a session, against their user account, and gives their browser a cookie that matches it. Every login on a different browser or device creates another session. Your work laptop, your home computer and your phone are three separate sessions on the same account.
Without “Remember Me” ticked, a login normally lasts about two days. With it ticked, it lasts about two weeks. Closing the tab does not end a session, and neither does turning off the device. That is why an old, forgotten login can still be live long after you stopped thinking about it.
Ending a session deletes that record. The next time the browser holding the old cookie tries to load the dashboard, WordPress no longer recognises it and shows the login screen instead.
Log out of every other device on your own account
This is the quick fix for the lost phone. It keeps you logged in where you are and ends everything else.
- Go to Users → Profile (some sites show it as your name in the top right corner, then Edit Profile).
- Scroll almost to the bottom, to the Sessions section under Account Management.
- Click Log Out Everywhere Else.
If the button is greyed out and WordPress says you are only logged in at this location, there are no other sessions on your account and nothing more to do here.
If you think the password itself may be known to someone else, change it on the same screen as well. Ending sessions removes people who are already in; a new password stops them logging straight back in. Our guide to changing your WordPress password from the profile screen covers the password generator and what makes a good one.
End the logins of one other user
An administrator can do the same thing for anyone else on the site. This is useful when a staff member reports a lost device, or when you are about to change someone’s access and want them out first.
- Go to Users → All Users and click the person’s name.
- Scroll to the Sessions section on their profile. It only appears when that person is logged in somewhere; if it is missing, they have no active logins.
- Click Log Out Everywhere. On another person’s profile, the button logs them out of all locations, including the device they are using right now.
They can log back in with their password unless you change it, change their role or remove the account. Changing a user’s password also invalidates the logins they already have, because the login cookie is tied to the password, so a reset on its own pushes them out too.
If this person is leaving the business, ending their sessions is only one item on a longer list. The guide to removing access when an employee leaves covers the hosting, email and other accounts that WordPress cannot see.
Log out all sessions in WordPress for every user at once
Sometimes you want every account on the site signed out: after a former contractor may have copied a login, after a shared password was posted in a group chat, or simply as a reset when you are tidying up who has access. There are three ways, from gentle to heavy.
One user at a time
On a small site with five or six accounts, the simplest route is to open each profile and use Log Out Everywhere. It takes a few minutes and changes nothing else.
Changing the security keys and salts
Every WordPress site has eight long random strings in its wp-config.php file, with names such as AUTH_KEY and LOGGED_IN_SALT. WordPress uses them to sign login cookies. Replace them with new values, and every existing cookie stops matching, so everyone on the site is logged out, you included.
It works, but you are editing the one file that holds your database details, so treat it as a careful job:
- Take a fresh backup first, and make sure it includes wp-config.php. Our step-by-step WordPress backup guide covers the options if you have none yet.
- Download a copy of wp-config.php through your hosting file manager or SFTP and keep it safe, so you can put the original back if something goes wrong.
- Get new values from the official generator at api.wordpress.org. Each visit gives a fresh set.
- In wp-config.php, replace only the eight define lines for the keys and salts. Leave the database name, user, password and everything else untouched. Watch the quotes and semicolons: one missing character can stop the whole site loading.
- Save, then reload the site in a private window. You will be asked to log in again, and so will everyone else.
If your host offers WP-CLI, the command wp config shuffle-salts does the same replacement for you. Some security plugins also have a button for it. Whichever route you use, the backup comes first.
Two side effects to expect. Any half-filled form in the dashboard, or an editor tab left open, will fail to save once its security token expires, so warn your team before you do it. And a few plugins use these keys to encrypt things they store, such as a connection to an outside service, so you may need to reconnect one or two integrations afterwards.
A plugin that manages sessions
Some security and activity log plugins add a screen for sessions, with options to end them in bulk or limit how many logins each account can hold. Features differ between plugins and between free and paid versions, so check the plugin’s own description rather than assuming.
Can you see who is logged in?
Not in core WordPress. The sessions are stored, but there is no screen that lists them across all users. The only built-in hint is the Sessions section on each profile: if Log Out Everywhere Else is clickable on your own account, there is at least one other login somewhere.
If you want to see who is logged in and what they did, you need an activity log plugin, installed in advance. It records logins, failed attempts and changes, with the account and time for each. Our post on seeing who changed what in WordPress explains which plugins do this and what is worth recording for a small team. Your host may also be able to run WP-CLI’s session listing for a particular user if you need an answer today.
When logging people out is not enough
Ending sessions is housekeeping. It is the right step for a lost phone, a departing employee or a password that travelled too far. It is not a cure for a site that someone has broken into.
If you see an administrator you do not recognise, pages you did not create, or redirects to strange sites, an attacker may have left other ways back in that have nothing to do with logins. Read what an activity log can show after a hack and treat it as a security incident, not a session clean-up. For the broader picture of who should have an account in the first place, see our guide to managing WordPress users and their access, and the rest of our guide on how to manage a WordPress website.
Frequently asked questions
Will logging out all sessions delete any content or drafts?
No. Ending a session only removes the login record. Posts, pages and saved drafts stay exactly as they were. The one thing at risk is unsaved work in a tab that was open at that moment, because the editor will ask the person to log in again before it can save. Ask people to save first if you can.
Does the WordPress mobile app get logged out too?
It depends on how the app is connected. If it signs in to your site with your username and password or an application password, ending sessions alone may not cut it off. Change the password or revoke the application password from your profile to be sure. If it connects through a WordPress.com account, manage it from there as well.
How often should I log everyone out?
There is no need for a fixed schedule on a healthy site. Do it when there is a reason: a lost or stolen device, someone leaving, a password that was shared too widely, or a contractor finishing work. Logging everyone out regularly without a reason mostly annoys your team and achieves very little.
Will my visitors or customers notice if I change the salts?
Ordinary visitors who never log in will not notice anything. Anyone with an account will be asked to log in again, which on a shop includes customers who were signed in to their account pages. Their orders and details are not affected. Choose a quiet time of day and expect a few people to use the password reset link.
If you would rather not edit wp-config.php yourself, or you are not sure whether a stray login is housekeeping or something worse, our WordPress support team can look at the accounts and sessions with you and explain what we find before changing anything.
Next in this series: WordPress User Registration Settings: Keep Them Off?
