Force logout, four ways
A row action for one user, a bulk action for selected users, by role in batched chunks, or everyone at once in a single query. Terminating a compromised account's access takes seconds, not a support ticket.
Oiko / plugins / sessions
Access control
Oiko Sessions
See exactly who holds a session on your site, end the ones that shouldn't be there — and flip a site-wide lockdown when you need everyone out. Built to stay fast on sites with hundreds of thousands of users.
free forever · no pro tier · no ads · nothing phones home
Price£0 — full feature set
Force logoutsingle · bulk · role · all
Presence storeown indexed table
Heartbeatthrottled, 60s default
Lockdownone switch, admins exempt
One-query logout"Log out everyone" is a single SQL statement — no user objects loaded, no memory spike.
Owns its tablePresence lives in its own indexed table — never an ALTER on wp_usermeta.
Checked every timeEvery action — single, bulk, lockdown — is nonce- and capability-checked.
Safe to removeDeactivating always releases a lockdown; uninstall drops only its own data.
What it does
Sessions, under your thumb.
Guard watches the front door; Sessions manages everyone already inside — visibility first, then the lever to act.
Presence on the users list
Last-login and online columns, sortable and batch-loaded in one indexed query. Users who have never logged in sort sensibly instead of silently vanishing from the list.
Access lockdown
One switch blocks every non-admin authentication attempt — for the middle of an incident, or a maintenance window. A persistent admin banner means nobody forgets it's on, and deactivating the plugin always releases the lock.
Settings that respect scale
Online threshold (how recent counts as "online"), heartbeat throttle (how often presence writes), role-logout batch size, and the message blocked users see — all tunable, all sane by default.
Why it exists
Born from an audit.
Oiko Sessions began with a full audit of a widely used force-logout plugin — the kind of review WP HealthKit runs every day. It found four problems worth fixing properly, so rather than patch around them, we rebuilt the idea on the Oiko boilerplate.
The result does the same job — log users out, see who's in, lock the doors — with the queries, checks and storage a large site actually needs.
- 01Unthrottled per-request database writes → a 60-second heartbeat throttle.
- 02A race-prone, unbounded status store → its own indexed presence table.
- 03An unbatched "log out everyone" that could exhaust memory → one SQL query, or chunked by role.
- 04A missing permission check on the bulk action → nonce- and capability-checked, everywhere.
Built the Oiko way
oiko-plugin-boilerplatePHP 8.3+ · WP 6.7+PHPUnit + WP_MockdbDelta versioned upgradesno usermeta ALTERsclean DROP TABLE uninstall
Questions
Fair ones.
Will "log out everyone" slow my site down?+
No. The all-users action is a single SQL statement against WordPress's own session storage — no user objects are loaded into memory. Role-based logouts run in batched chunks (1,000 per pass by default, tunable), which is how the plugin stays comfortable on sites with 250,000+ users.
Can lockdown lock me out of my own site?+
Administrators always pass — lockdown only blocks non-admin authentication. And as a safety net, deactivating the plugin releases the lock automatically, so the standard "rename the plugin folder" escape hatch works too.
What does uninstall leave behind?+
Nothing. The plugin drops its own presence table and deletes its own options — and touches nothing else. It never alters shared core tables, so there's no cleanup debt if you move on.
Also free