Access

User security console

Pro and AgencyAbout User Security Console

Shows each user's security at a glance: two-factor, password strength and age, last sign-in and every device they are signed in on, with buttons to end sessions.

What it does

The User console lists your users with filters for Admins, No 2FA and Dormant. Pick a user to see their role, two-factor status, password strength, password age, last sign-in and Stack Guard access level.

Active sessions lists every browser and device the user is signed in on, with the address, when it signed in and when it was last active. End signs out one session; Sign Out Everywhere signs out all of them.

A dormant administrator is one who has not signed in for 90 days, or never since this was recorded.

Why it matters

Old administrator accounts from past staff or agencies are a favourite way in. The Dormant filter finds them so you can remove them or lower their role.

If a laptop is stolen or a password leaks, ending that person's sessions stops anyone already signed in as them.

Use it

Go to the Access tab, section User console.
Use the search box or the filters to find a user, then click their name.
Review the profile. To end one device, click End beside it. To end all, click Sign Out Everywhere.
To make one person use two-factor sign-in, switch on Require two-factor for this user. This works when Require 2FA on the Login tab is set to Specific Users.

Good to know

Your own current session is marked and cannot be ended from here, so you do not sign yourself out by accident.

The console lists up to 50 users.

Suspending an account and sign-in history per user are on the roadmap.

Which plan includes it

The user list and your own profile are in every plan. Opening other users, the session list and ending sessions, dormant administrator flags and the per-user two-factor switch are part of Pro, and the actions need full access to Stack Guard.

How it works, for developers

Sessions come from WordPress's own session store (user meta session_tokens). Only a SHA-256 fingerprint of each session reaches the browser, never the token itself. If another plugin replaces the session store, sessions are listed read only.
Last sign-in is the later of user meta smg_last_login (stored in UTC on wp_login, only after two-factor passes) and the newest session start.
The dormant limit is 90 days and can be changed with the smg_dormant_admin_days filter.
AJAX actions: smg_get_user_security_profile, smg_end_user_session (limited to 20 in 5 minutes), smg_force_logout_user, smg_set_user_require_2fa (edits the same smg_require_2fa_users list as the Login tab). Each checks a nonce, capability, full access and the Pro feature.

Quick answers about user security console

What does User security console do in Stack Guard?

The User console lists your users with filters for Admins, No 2FA and Dormant. Pick a user to see their role, two-factor status, password strength, password age, last sign-in and Stack Guard access level. Active sessions lists every browser and device the user is signed in on, with the address, when it signed in and when it was last active. End signs out one session; Sign Out Everywhere signs out all of them. A dormant administrator is one who has not signed in for 90 days, or never since this was recorded.

Why use user security console on a WordPress site?

Old administrator accounts from past staff or agencies are a favourite way in. The Dormant filter finds them so you can remove them or lower their role. If a laptop is stolen or a password leaks, ending that person's sessions stops anyone already signed in as them.

How do I set up user security console?

1. Go to the Access tab, section User console. 2. Use the search box or the filters to find a user, then click their name. 3. Review the profile. To end one device, click End beside it. To end all, click Sign Out Everywhere. 4. To make one person use two-factor sign-in, switch on Require two-factor for this user. This works when Require 2FA on the Login tab is set to Specific Users.