Skip to content

Sign-in

Sign-in errors and sessions

Every planAbout Login Protection

Stops the sign-in page from telling strangers which usernames exist, signs out sessions left idle, and caps how long "Remember me" keeps someone signed in.

What it does

Hide login error details: normally WordPress says "unknown username" or "wrong password", which tells a robot when it has found a real account. With this on, both mistakes show the same message: "The username, email address or password is incorrect."

Idle sign-out: if someone leaves a signed-in browser alone for the number of minutes you choose, the next page they open asks them to sign in again.

"Remember me" length: how many days a ticked "Remember me" box keeps a person signed in. WordPress uses 14 days unless you change it.

Why it matters

Half of a password guess is the username. Hiding which part was wrong makes guessing much slower.

A laptop left open in a café or a shared office computer is an open door. Idle sign-out and a shorter "Remember me" close it on their own.

Set it up

  1. Go to the Login tab, section Sign-in security, panel Sessions.
  2. Switch on Hide login error details.
  3. In Idle sign-out, type a number of minutes, for example 60. Use 0 to switch it off. Any value is kept between 5 minutes and 7 days.
  4. In "Remember me" length, type a number of days, for example 7. Use 0 to keep the WordPress default of 14 days.
  5. Click Save Changes.

Good to know

Messages about lockouts, CAPTCHA and two-factor still show as normal, so real people know what to do.

Someone signed out for being idle in the admin area sees "You were signed out because the session was idle" and returns to the same page after signing in.

An open admin tab that only sits there does not count as activity, so idle sign-out still works when a tab is left open.

Limiting how many sessions one user may have at once is on the roadmap.

Which plan includes it

Hiding login error details is included in every plan, including Free. Idle sign-out and the Remember me length are part of Pro; on Free, sessions follow the WordPress defaults and any values saved earlier are kept.

How it works, for developers
  • Error hiding runs on the authenticate filter at priority 100. It only replaces the error when every error code is invalid_username, invalid_email or incorrect_password, so the activity log and the wp_login_failed action still see the real reason.
  • Idle sign-out stores the last activity time as smg_last_activity inside the WordPress session token (user meta session_tokens), written at most once a minute. The check runs on init at priority 1. The admin heartbeat is ignored.
  • Sign-ins without a cookie session, such as application passwords and scheduled tasks, are not affected by idle sign-out.
  • "Remember me" length uses the auth_cookie_expiration filter at priority 20 and only applies when the box is ticked.
  • Settings: smg_login_generic_errors, smg_session_idle_timeout (minutes), smg_remember_me_days. The recovery switch SMG_DISABLE_LOGIN_GUARD also turns these off.

Quick answers about sign-in errors and sessions

What does Sign-in errors and sessions do in Stack Guard?

Hide login error details: normally WordPress says "unknown username" or "wrong password", which tells a robot when it has found a real account. With this on, both mistakes show the same message: "The username, email address or password is incorrect." Idle sign-out: if someone leaves a signed-in browser alone for the number of minutes you choose, the next page they open asks them to sign in again. "Remember me" length: how many days a ticked "Remember me" box keeps a person signed in. WordPress uses 14 days unless you change it.

Why use sign-in errors and sessions on a WordPress site?

Half of a password guess is the username. Hiding which part was wrong makes guessing much slower. A laptop left open in a café or a shared office computer is an open door. Idle sign-out and a shorter "Remember me" close it on their own.

How do I set up sign-in errors and sessions?

1. Go to the Login tab, section Sign-in security, panel Sessions. 2. Switch on Hide login error details. 3. In Idle sign-out, type a number of minutes, for example 60. Use 0 to switch it off. Any value is kept between 5 minutes and 7 days. 4. In "Remember me" length, type a number of days, for example 7. Use 0 to keep the WordPress default of 14 days. 5. Click Save Changes.

Which Stack Guard plan includes sign-in errors and sessions?

Hiding login error details is included in every plan, including Free. Idle sign-out and the Remember me length are part of Pro; on Free, sessions follow the WordPress defaults and any values saved earlier are kept.

More in Sign-in

Not running Stack Guard yet? It is free.

Download Free