Name: Netdesign Session Guard
Author: Netdesign

Selling courses, memberships or subscriptions? Session Guard shows you when one account is used by several people, and can stop it.

Live view

Everyone signed in right now: user, device and browser, IP and country, the page they’re on, and when they were last seen. Users on more than one device at the same time stand out. Sign out any device with one click.

Account-sharing detection with risk levels

The clearest sign of a shared account is two devices used at the same moment. Session Guard records every overlap (two devices of one account active together), and rates it:

Weak: two devices active together longer than the grace period.
Very strong: the devices were in different countries, or it keeps happening (several times in a week).
With the Pro add-on, which detects video playback: medium (only one device watching a video) and strong (both watching at the same time).

Accounts from the level you choose are listed under Flagged accounts, with a plain explanation, for example “Two devices were active at the same time 3 times in the last 30 days, 18 min in total. The devices were on the same internet connection.” A “How to read the risk levels?” box explains each level.

Handle each case

Handling status for every flagged account: New, Needs follow-up, Caught and blocked, or Checked, OK. Filter the list by status.
Notes on any user (“called the student, the second phone is his wife’s”), with author and date.
Online at the same time: each user’s page lists the periods when two of their devices were active together, how long, from which devices, and whether from the same network.
Sign the user out everywhere, or exclude them from monitoring (test accounts, staff). The Excluded users tab lists them, and the setting of the same name lets you paste a list of emails or user IDs.
Monitoring switch: turn collection off without deleting anything.

Device limit

Allow N devices per account, one by default. When someone signs in on another device, the oldest device is signed out immediately. An open tab gets the message within seconds, and any other device is signed out on its next click. Tabs in the same browser count as one device. Administrators (or any roles you choose) and whitelisted users are never limited.

Built to stay light

Normal page views add no database queries. Activity comes from a small heartbeat that runs only while the tab is visible, detection runs every 5 minutes in the background, and old history is cleaned up automatically.

Automatic client-IP detection behind Cloudflare and local proxies, which visitors can’t fake.
Right-to-left support; Hebrew translation included.
Imports sessions that were already open when you activate it.

Session Guard Pro

An optional paid add-on, sold separately by Netdesign, adds:

video detection (Vimeo, YouTube, HTML5) for the medium and strong levels, and a viewing report for every overlap,
email alerts about flagged accounts and active suspects, with an email history, and a warning email to the user,
per-user device limits,
LearnDash: device limits per group, and the course each user is in,
a faster heartbeat endpoint.

This plugin works fully on its own.

Privacy

For every login session, Session Guard stores in your own database ({prefix}ndsg_sessions):

a hash of the WordPress session token,
a random device ID (the ndsg_did cookie, HttpOnly, valid 2 years),
the browser user agent,
the IP address (optionally anonymized) and its IP range,
the country code, when Cloudflare or the server provides one,
the last page visited, and timestamps.

Flags store the user ID, the rule values and the handling status. Overlaps store the two sessions, their networks and the times. Notes store the text, its author and the date.

Ended sessions and overlaps are deleted after 90 days (configurable). Notes are kept until you delete them or the user. Deleting a user deletes their data. Uninstalling the plugin removes all of its data.

External request (off by default): only if you turn on Settings Advanced Update Cloudflare IP ranges, the plugin downloads Cloudflare’s public list of IP ranges from https://api.cloudflare.com/client/v4/ips once a day. It uses them only to recognize requests coming through Cloudflare. While the setting is off, or if the download fails, the list built into the plugin is used. No data about your site or users is sent anywhere. This service is provided by Cloudflare, Inc.: Terms of Use, Privacy Policy.

Mention this processing in your site’s privacy policy. A suggested text: “To protect accounts from unauthorized sharing, we record the devices, approximate location (IP address and country) and activity times of signed-in sessions, for up to 90 days.”

Netdesign Session Guard