You sign in to WordPress at a coffee shop, check a post, close the lid and leave. How long until that browser stops being signed in? If you have not changed anything, the honest answer is days. That is the gap WordPress auto logout is meant to close.
This guide explains how WordPress sessions really work, why idle ones are a risk, and how to set up WordPress auto logout with a code snippet or a plugin, without annoying your team.
Why Idle Sessions Are Risky
A signed-in browser is a key that stays in the lock. Anyone who sits at that computer can use it, and WordPress will not ask for a password again.
A few real-life ways this goes wrong:
- Shared computers. A front desk PC, a family laptop, a co-working space machine. Someone signs in, forgets to sign out, and the next person has an administrator account.
- Lost or stolen laptops. If the device is lost while signed in, the thief does not need your password. The session is already open.
- Cookie theft. Malware on a computer, or a malicious browser extension, can lift your sign-in cookie. A cookie is a small file your browser stores to prove you are signed in. If someone copies it, they can act as you without ever knowing your password, and two-factor does not help, because that step happened earlier.
- The tab you forgot about. An admin page left open overnight on a work computer. Low risk at home, higher risk in an office.
None of these are exotic. They are the ordinary, slightly embarrassing ways accounts get misused. And the longer a session lasts, the longer that stolen cookie or forgotten tab stays useful.
Shorter sessions do not stop the first break-in. They shrink the window. That is the whole idea.
How WordPress Sessions and Remember Me Work by Default
When you sign in, WordPress gives your browser an authentication cookie. As long as that cookie is valid, you are "logged in".
The lifetime depends on one checkbox:
| Sign-in type | Cookie lifetime by default |
|---|---|
| Normal sign-in | 2 days |
| Remember Me ticked | 14 days |
The WordPress developer reference for wp_set_auth_cookie() describes it this way: with Remember Me the cookie is persistent and lasts 14 days, while without it the cookie is meant to end with the browser session, but the auth_cookie_expiration filter still applies with a default of two days. In practice, a person who unticks Remember Me is signed out after two days or when the browser closes, whichever comes first.
The key point is what is missing. WordPress has no idle timer. It does not track whether you are actually using the site. Click around for five minutes on day one, walk away, and you are still signed in on day two.
That default is friendly for you and generous to anyone else who gets hold of the device.
Where Remember Me Fits In
The Remember Me box is a convenience, and a good one on a laptop that only you use. It is a poor idea on anything shared. Because it quietly stretches the session to two weeks, it is the biggest source of long-lived sign-ins.
If you run a site with several editors, the realistic goal is not "ban Remember Me". It is "make sure the damage is limited when someone forgets what they ticked".
Option 1: A Code Snippet for Shorter Sessions
WordPress gives you a filter called auth_cookie_expiration. A filter is a hook that lets code change a value before WordPress uses it. This one changes how long the sign-in cookie lasts. The reference page for the hook shows it receives the length in seconds, the user ID, and whether Remember Me was ticked.
Here is a simple snippet that makes normal sign-ins last 8 hours and Remember Me last 3 days:
add_filter( 'auth_cookie_expiration', function ( $length, $user_id, $remember ) {
if ( $remember ) {
return 3 * DAY_IN_SECONDS;
}
return 8 * HOUR_IN_SECONDS;
}, 10, 3 );
Put it in a small custom plugin or your theme's functions.php (a custom plugin survives theme changes, so it is the better place). If you are writing admin code of your own, our guide to the WordPress nonce covers the other half of keeping it safe. Sign out and back in for it to apply, because it only affects new cookies.
What the Snippet Does Not Do
Be clear about what you have built. This is a fixed lifetime, not an idle timer. Someone who signs in at 9am is signed out at 5pm even if they were typing the whole time, and someone who walks away at 9:05am is still signed in until 5pm.
For many sites that is good enough. A shorter fixed session is better than 14 days, and it is zero extra software. If you want sign-out based on inactivity, you need something that tracks activity, which is where a plugin comes in.
Option 2: A WordPress Auto Logout Plugin With an Idle Timer
Several plugins add an idle timeout. They work by recording the last time you did something and checking it on the next page load. If too much time has passed, they end the session and send you back to the sign-in screen.
When you compare options, check a few things:
- Does it count real activity? An admin tab that just sits there should not keep the session alive. WordPress sends background pings (the Heartbeat) every so often, and a badly built timer treats those as someone being at the keyboard.
- Can you set different limits by role? Editors on a shared newsroom PC may need a shorter limit than the site owner.
- Does it return people to where they were? Nobody enjoys losing a half-written post to a session timeout.
- Does it cover API and application password use? Scheduled tasks and app logins should not be broken by an idle timer meant for people.
For a deeper look at how WordPress secures sign-ins in general, the hardening checklist shows where session limits sit among the other basics.
Stack Guard Pro: Idle Sign-Out and Your Own Remember Me Length
Stack Guard's Login Protection includes both settings in Pro.
Idle sign-out. You type a number of minutes, for example 60. If someone leaves a signed-in browser alone for that long, the next page they open asks them to sign in again. Values run from 5 minutes up to 7 days, and 0 switches it off. They see a short message explaining that the session was idle, and they return to the same page after signing in.
A detail that matters: an open admin tab that only sits there does not count as activity, and the WordPress Heartbeat is ignored. So leaving a tab open does not hold the session open.
Your own Remember Me length. You set how many days a ticked Remember Me box keeps someone signed in, for example 7. Use 0 to keep the WordPress default of 14 days. It uses the same auth_cookie_expiration filter as the snippet above, and only applies when the box is ticked.
Sign-ins that do not use a browser cookie, such as application passwords and scheduled tasks, are not touched by idle sign-out, so your automations carry on.
On the Free plan, sessions follow the WordPress defaults. Plenty of Login Protection is free, including the custom sign-in address and generic errors, but these two session settings are Pro. The full details are in the login policy docs, and pricing shows what each plan costs.
A Sensible Starting Point
If you are not sure what numbers to pick, start here and adjust after a week:
| Who you are | Idle sign-out | Remember Me |
|---|---|---|
| Solo owner on a personal laptop | 120 minutes | 14 days (or leave it) |
| Small team with a shared office PC | 30 to 60 minutes | 7 days |
| Client sites you manage | 60 minutes | 7 days |
For client sites, tell the client why in one sentence. They tend to accept "it keeps the site safe if you forget to close the browser".
If people complain, raise the number before you remove the rule. A 4 hour limit still beats 14 days.
Ending a Session You Do Not Trust
Auto logout handles the forgetful case. Sometimes you need to act now: a lost phone, a contractor who left, an account you suspect is being used by someone else.
WordPress itself has a Log Out Everywhere Else button on your own profile, and an administrator can use Log Out Everywhere on someone else's profile. What core does not show you is which sessions exist, where they are or how old they are, so you are acting blind. The bigger hammer is changing the security keys in wp-config.php (see WordPress salts), which signs out every user on the site at once. That works, but it is a sledgehammer.
With Stack Guard Pro, the User Security Console shows each user's role, password age, two-factor status and live sessions. You can end a single session, or all of a user's sessions at once, without touching anyone else. It also flags dormant administrators who have not signed in for 90 days, which is a good place to find old accounts nobody remembers.
If you want to go further, pair it with two-factor sign-in (see the two-factor guide) and a password reset for the affected person. And if you think the problem is bigger than one account, our article on the signs your WordPress site has been hacked lists what to look for next.
Common Mistakes With Session Limits
A few things go wrong often enough to be worth a mention.
Setting it too short. A 5 minute limit sounds secure and feels like a prank. People will find workarounds, like keeping a tab open with a refresh extension, which defeats the point. Choose a limit people can live with.
Forgetting caching. If a caching plugin serves pages to signed-in users, the "next page load" that triggers the check may come later than you expect. Test with the real setup, not just in a clean browser.
Only changing the admin. Editors, shop managers and contributors can all do damage. Apply the rule to everyone who can sign in, or at least to everyone with write access.
Forgetting application passwords. Idle sign-out only affects browser sessions. Apps that use WordPress application passwords carry on regardless, so review those too.
Testing while signed in as the only admin. Keep a second administrator account or SSH access handy the first time you change session rules. If something misbehaves, you want a way back in that does not depend on the setting you just changed.
Treating auto logout as a substitute for the basics. It reduces risk after the fact. If your main account is still called admin, change that username too. It does not stop password guessing or a vulnerable plugin. Lockouts, strong passwords and two-factor still do that work.
Wrapping Up WordPress Auto Logout
WordPress will keep a browser signed in for two days, or two weeks with Remember Me, and it has no idea whether anyone is still there. For a personal blog on a personal laptop, that is a small risk. For a site with a team, a shared computer or a client's data, it is worth tightening.
Start with the cheap fix: a code snippet that shortens the cookie. If you want real inactivity sign-out and a Remember Me length you can set from a settings screen, use a plugin that tracks activity properly. Then keep an eye on who is signed in, and know how to end a session quickly when you need to.
Small change, calmer mind.