east115 Account Guard

Membership sites lose revenue every day to shared accounts — one login passed around an office, posted in a group chat, or resold. This plugin limits account sharing using WordPress native session management (WP_Session_Tokens). No polling, no extra server load.

Three configurable strategies:

• Kick oldest (kick, default) — a new login instantly terminates all other sessions of that account. The old device is logged out on its next request. Smoothest experience, similar to single-device streaming policies.
• Exclusive online (deny) — while any device is active, new-device logins are rejected outright. Strictest mode.
• Device binding limit — each account can bind up to N devices (default 2), slots auto-release after X days (default 30). An anonymous device identifier cookie is set on first login.

More features:

• Heartbeat detection: every visit refreshes activity time (60-second write throttle, no slowdown)
• Admin exemption: administrators can bypass all restrictions
• Unbind tool: one click in the admin to clear a user’s device bindings and force all devices offline — perfect for device-change appeals
• Zero external dependencies: no third-party requests, all data stays in your database

The plugin interface is written in Chinese and fully internationalized (text domain: east115-account-guard). Translations for other languages are welcome via translate.wordpress.org.

Privacy

This plugin collects and transmits no personal data. The only data stored is an anonymous device-identifier cookie (eastacgu_device) in the browser and device binding timestamps in user meta. Uninstalling removes all settings and binding data.