Since version 1.3.0: BricksMembers includes session limits and device management as an Access Control feature for limiting concurrent logins, giving members a Bricks-native device management screen, and optionally alerting users about new-device logins.
Membership sites eventually run into a practical question: how many people should be able to use the same account at the same time? For small communities, that question may not matter. For paid courses, private academies, team licenses, client portals, or enterprise learning sites, it becomes part of access protection.
BricksMembers session limits add that protection at login. Instead of only checking whether a member can view a protected page, BricksMembers can also check whether the user already has too many active device sessions. When the limit is reached, the experience can stay soft and user-friendly: the member sees a session management screen, reviews their devices, ends an older session, and continues.
This gives you account sharing protection without turning the login experience into a confusing hard block.
What session limits do
A session is an active login for a user account. If someone logs in on a laptop, phone, tablet, or another browser, WordPress stores a separate session token for that login. BricksMembers reads those WordPress sessions and can apply a concurrent session limit.
- You can set one default limit for everyone.
- You can set different limits by WordPress role.
- You can set different limits by BricksMembers level.
- You can let administrators bypass enforcement while still allowing them to manage their own devices.
- You can optionally send an email when a login appears to come from a new device.
The limit value 0 always means unlimited. If a user matches more than one rule, BricksMembers uses the highest positive limit. This is intentional because role and level combinations can overlap on real sites. The highest-limit rule prevents an accidental restrictive rule from surprising a member who also belongs to a more permissive plan.
Two ways to handle users over the limit
BricksMembers supports two operating modes. Choose the one that matches your support style and your audience.
Soft gate
Soft gate is the friendliest option. When a user logs in and is over the limit, BricksMembers sends them to your session management page. They see their active sessions, including the current device, masked IP information, login time, expiration time, and an action to end another session. Once they are within the allowed limit, they can continue to the page they originally requested.
This is the recommended mode for most membership sites because users stay in control and support tickets are easier to understand.
Auto oldest
Auto oldest removes friction. When the limit is reached, BricksMembers automatically ends the oldest non-current session and lets the new login continue. The current login is never destroyed automatically.
This works well when your priority is a fast login flow and you are comfortable ending older device sessions without asking the user first.
When to use session limits
- Paid course sites: limit one student account to one or two active devices.
- Corporate training portals: give employees a fair number of devices while preventing account sharing outside the organization.
- Premium content libraries: discourage shared logins without locking real customers out permanently.
- Team and group license sites: combine session limits with group seats so the license controls who can access the site and session limits control how the account is used.
You do not need session limits on every site. If your content is free, low-risk, or intentionally shareable, leave the feature disabled. It is disabled by default and adds no enforcement until you turn it on.
Create the session management page
Soft gate mode needs a frontend page where users can manage their active sessions. In BricksMembers, this page is a Bricks page that contains the native BRM Session Management element.
Add the Bricks element
Add the BRM Session Management element to the page you want to use as the session management page. The element renders the current user’s session list and includes content controls for the heading, masked IP display, and login time display.
Style the element with normal Bricks controls, classes, and theme styles. The element includes shared BricksMembers button controls and visible content-tab styling groups for the screen, text, notices, session rows, badges, meta text, action buttons, and messages. BricksMembers also stores structural defaults as hidden Bricks controls so the generated rows, notices, badges, and buttons have sensible defaults without loading a separate frontend stylesheet.
Logged-out visitors see a login-required message. Logged-in users see their own active sessions only. There is no shortcode and no Gutenberg block for this screen.
Enable session limits
After creating the management page, open BricksMembers -> Access Control -> Sessions.
- Turn on Enable session limits.
- Choose Soft gate or Auto oldest.
- Set the default concurrent session limit. Use
0for unlimited. - Select the session management page if you use Soft gate mode.
- Optionally enable new-device email alerts.
- Decide whether administrators should bypass enforcement.
- Add per-role or per-level limits only when the default limit is not enough.
- Save the settings.
If Soft gate mode is enabled without a management page, BricksMembers saves the setting but does not enforce the gate. The admin screen shows a warning so you can finish the setup safely before users are affected.
How role and level limits work
Most sites should start with one global limit. Add scoped rules only when different member types genuinely need different behavior.
| Rule type | Example | What happens |
|---|---|---|
| Global | Limit 2 | Every user can have up to 2 active sessions unless a higher role or level limit matches. |
| Role | Customer role limit 3 | Users with that WordPress role can have up to 3 active sessions. |
| Level | Enterprise level limit 5 | Users with the active BricksMembers level can have up to 5 active sessions. |
| Unlimited | Limit 0 | The rule is ignored for enforcement. |
If a user matches Global 2, Customer Role 3, and Enterprise Level 5, the effective limit is 5. BricksMembers does not add the numbers together. It chooses the highest positive limit.
New-device email alerts
When new-device alerts are enabled, BricksMembers sends the user a plain-text email after a login appears to come from a device it has not seen before. The email includes the device label, masked IP address, login time, and site name.
The device fingerprint is intentionally lightweight. BricksMembers uses the browser family, platform family, and masked IP prefix. It does not store the raw full IP address in the fingerprint. Known devices are capped so the user meta stays small over time.
The alert is not a replacement for two-factor authentication. It is a helpful account-awareness layer, similar to the familiar “new login” emails that users already understand.
What users see
The session management screen shows each active session for the current account. A row can include:
- Device label such as Chrome on macOS or Safari on iPhone.
- A This device badge for the current session.
- Masked IP address when enabled.
- Login time when enabled.
- Session expiration time.
- An End session action for other sessions.
The current session cannot be ended from the management screen. Users should use the normal logout link when they want to end the device they are currently using.
Performance and privacy notes
Session limits are designed for large sites. BricksMembers does not scan every user, every account, or every session on the site. Enforcement is per-user and runs on login or while a pending user is on the management flow.
- Active sessions are read from WordPress’s existing per-user session token storage.
- Pending soft-gate state is stored as small user meta and expires after 15 minutes.
- Known devices are stored as capped user meta.
- Settings are cached in the request.
- Session termination is protected by a per-user concurrency lock.
For most membership sites, this avoids the complexity of a custom database table while keeping the runtime path predictable and scalable.
Best practices
- Start with Soft gate mode before switching to Auto oldest.
- Use a global limit first. Add role or level limits only when needed.
- For paid courses, a limit of 2 is often friendlier than a limit of 1 because many legitimate students use a laptop and a phone.
- Keep admin bypass enabled unless your team specifically needs administrators to experience the same enforcement as members.
- Test the flow with two browser profiles before enabling it on a live enterprise site.
- Keep the management page simple and easy to find from the member account area.
Troubleshooting
The user is not redirected to the management page
Check that session limits are enabled, the user has a positive effective limit, and Soft gate mode has a published management page selected. A limit of 0 means unlimited and does not trigger enforcement.
The user cannot continue
The user still has more active sessions than their effective limit allows. They need to end enough non-current sessions before the Continue action becomes available.
The email alert repeats too often
Very mobile users, VPN users, and privacy-focused browsers can appear as new devices more often because network and browser signals change. If alerts become noisy for your audience, turn them off or increase your support messaging around them.
The practical takeaway
Session limits are not about punishing customers. They are about protecting paid access in a way that still respects real users and real devices. BricksMembers gives you both options: a soft management flow for most sites, and an automatic oldest-session fallback for sites that want the least possible friction.