SessionPilot
SessionPilot is a WordPress plugin that gives site admins complete visibility and control over logged-in user sessions. It replaces a combination of 2-3 paid plugins with one unified, fully free tool.
by Shiv Singh · github.com/programmernomad/sessionpilot · website
Install
No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:
wp plugin install https://github.com/programmernomad/sessionpilot/archive/refs/heads/main.zipOpen-source session & activity monitoring for logged-in WordPress users
Self-hosted · Privacy-first · No SaaS · No telemetry · Free forever
What is SessionPilot?
SessionPilot is a WordPress plugin that gives site admins complete visibility and control over logged-in user sessions. It replaces a combination of 2-3 paid plugins with one unified, fully free tool.
It is NOT an analytics platform, visitor tracker, or security scanner. It tracks only authenticated (logged-in) WordPress users.
Features (v1)
| Feature | Description |
|---|---|
| Session Management | View all active sessions with device, browser, OS, IP, and last-seen |
| Force Logout | Terminate any session instantly -single user, by role, or all |
| Concurrent Limits | Restrict simultaneous sessions globally, per role, or per user |
| Idle Timeout | Auto-expire sessions after configurable inactivity period |
| Browser-Close Detection | Best-effort logout when tab closes (heartbeat-based) |
| Online Users Dashboard | See who is logged in right now, active session counts, recent activity |
| Activity Logs | Audit trail for logins, logouts, role changes, plugin/theme events, settings changes |
| Device Tracking | Browser name, OS, device type, IP history per user |
| Session Rules | Per-role and per-user session policies with configurable enforcement modes |
| Email Alerts | Notify admin on limit exceeded or repeated login failures |
| CSV Export | Download sessions and activity logs as CSV |
| REST API | Full /sp/v1/ endpoint set for automation and integrations |
| WP-CLI | Manage sessions, logs, rules, and devices from the command line |
| Cleanup Cron | Auto-purge expired sessions and old logs on a schedule |
Why SessionPilot?
Most competitors split these features across multiple paid plans. SessionPilot ships everything free:
| What You'd Normally Pay For | SessionPilot |
|---|---|
| Force logout -WP Activity Log Pro (~$149/yr) | ✅ Free |
| Concurrent session limits -SessionQuota Pro ($49) | ✅ Free |
| Idle timeout -Inactive Logout Pro ($39/yr) | ✅ Free |
| Real-time active users -WP Activity Log Premium | ✅ Free |
| CSV export -Simple History Premium ($49/yr) | ✅ Free |
| Per-user session overrides -Loggedin add-ons ($29-$49) | ✅ Free |
| REST API -no competitor offers this | ✅ Free |
Requirements
| Requirement | Minimum | Recommended |
|---|---|---|
| WordPress | 6.4 | Latest |
| PHP | 8.2 | 8.3 |
| MySQL | 5.7 | Latest |
| MariaDB | 10.3 | Latest |
Installation
From ZIP (Recommended)
- Download
sessionpilot-1.0.0.zipfrom the Releases page - In WordPress admin, go to Plugins → Add New → Upload Plugin
- Upload the ZIP and click Install Now
- Click Activate Plugin
- Navigate to SessionPilot in the left menu
From Source (Development)
- Clone the repository into your WordPress plugins directory:
git clone https://github.com/ProgrammerNomad/SessionPilot.git wp-content/plugins/sessionpilot
cd wp-content/plugins/sessionpilot- Install PHP dependencies:
composer install- Install and build JS assets:
npm install
npm run build-
Activate the plugin in WordPress admin (
Plugins → SessionPilot → Activate).
Database tables are created automatically on activation. -
Run migrations manually (optional, via WP-CLI):
wp acorn migrateQuick Start
After activation, navigate to SessionPilot → Dashboard in your WordPress admin.
Force-logout a user via WP-CLI
wp sessionpilot sessions kill all --user=3Set a concurrent session limit for editors
wp sessionpilot rules set --role=editor --max=2 --mode=logout_oldestView active sessions
wp sessionpilot sessions list --active --format=tableTech Stack
| Layer | Technology |
|---|---|
| Backend framework | Roots Acorn (Laravel-style for WordPress) |
| ORM | Eloquent (admin models only) + raw $wpdb (high-frequency writes) |
| Frontend build | Vite |
| Frontend JS | Alpine.js + HTMX |
| Templating | Blade |
| Background jobs | WP-Cron (default) / Redis (optional) |
| Device detection | WhichBrowser + Mobile_Detect |
Documentation
Full documentation lives in the docs/ directory.
| Document | Description |
|---|---|
| Vision & Philosophy | What SessionPilot is and is not, core principles |
| Roadmap | v1 MVP scope, Phase 2 & 3 plans, build order |
| Architecture | Database schema, design rules, performance strategy |
| Product Modules | All feature modules in detail |
| Tech Stack | All libraries, tools, and rationale |
| Folder Structure | Plugin directory layout |
| API Reference | WP-CLI commands and REST API endpoints |
| Security | Security strategy, GDPR compliance, threat model |
| UI/UX Direction | Admin dashboard design principles |
| Competitors | Feature matrix and competitive gap analysis |
| Contributing | Dev setup, coding standards, testing, CI/CD |
| Sustainability | Open-source model and future funding strategy |
Roadmap
v1 (current focus): Session engine, activity logs, online users dashboard, session rules, device tracking, REST API, WP-CLI, CSV export, email alerts.
Phase 2: WooCommerce intelligence module, extended analytics, GeoIP, Discord/Slack/Webhook notifications, suspicious activity detection.
Phase 3: Heatmaps, purchase journey tracking, AI/anomaly detection, multisite aggregation.
See docs/roadmap.md for full details and implementation build order.
Security
SessionPilot follows WordPress security best practices throughout:
- Capability checks on every admin action
- Nonce verification on all AJAX and form requests
- Prepared statements for all database queries (
$wpdb->prepare()) - Full output escaping before HTML rendering
- No raw SQL interpolation anywhere
To report a security vulnerability, please use responsible disclosure. Do not open a public issue.
See docs/security.md for the full security strategy.
Contributing
Contributions are welcome. Please read docs/contributing.md for:
- Local dev setup instructions
- Coding standards (PSR-12, ESLint)
- Testing requirements (PHPUnit + Vitest)
- Git workflow and PR process
License
SessionPilot is open source software released under the GPL v2 or later.
No Pro version. No license keys. No cloud dependency. Everything is free, forever.
Philosophy
"SessionPilot does in one free plugin what competitors charge $50-$150/year for across multiple paid products."
Built for WordPress admins and agencies who want full control over their users' sessions -locally, privately, and without vendor lock-in.