Why this matters
By default WordPress doesn’t include a way to monitor admin user logins. If an admin user account hasn’t been used in the last 3 months there is no way of knowing. Unless the site has 2FA in place, redundant user accounts add unnecessary risks to its security when they don’t need to.
Did that user choose a unique and secure password, or did they reuse their favourite one? Who knows. If the account isn’t being used it could be removed or downgraded to a lower role like an Editor just in case.
What it does
ToggleWP’s Session & Auth / Login Monitoring modules adds 3 additional columns to the Users screen to help you monitor admin user activity. These include their last login date, whether they are currently logged in and when they were last active (for example a mouse click in the admin area).
The logged in status is updated every minute, handy if you are about to do site maintenance and don’t want any other admin users on the site.
From the Users screen you can force logout another user, if they are still logged in when they shouldn’t be. You can also reset their last login date, which is useful if you have tested a client’s admin user for the emergency use only notification and now need to blank the login date.
Once a month the Administrator Activity Report email is sent to you. This lists all administrator accounts and their last login date (hence the reset last login above). Anything in red hasn’t been used in over 30 days.
