描述
Membership sites lose revenue every day to shared accounts — one login passed around an office, posted in a group chat, or resold. This plugin limits account sharing using WordPress native session management (WP_Session_Tokens). No polling, no extra server load.
Three configurable strategies:
- Kick oldest (kick, default) — a new login instantly terminates all other sessions of that account. The old device is logged out on its next request. Smoothest experience, similar to single-device streaming policies.
- Exclusive online (deny) — while any device is active, new-device logins are rejected outright. Strictest mode.
- Device binding limit — each account can bind up to N devices (default 2), slots auto-release after X days (default 30). An anonymous device identifier cookie is set on first login.
More features:
- Heartbeat detection: every visit refreshes activity time (60-second write throttle, no slowdown)
- Admin exemption: administrators can bypass all restrictions
- Unbind tool: one click in the admin to clear a user’s device bindings and force all devices offline — perfect for device-change appeals
- Zero external dependencies: no third-party requests, all data stays in your database
The plugin interface is written in Chinese and fully internationalized (text domain: east115-account-guard). Translations for other languages are welcome via translate.wordpress.org.
Privacy
This plugin collects and transmits no personal data. The only data stored is an anonymous device-identifier cookie (eastacgu_device) in the browser and device binding timestamps in user meta. Uninstalling removes all settings and binding data.
安装
- Upload and activate the plugin in the admin.
- Go to Settings – Prevent Account Sharing, pick a strategy and device limit.
- To handle device-change appeals, use the unbind tool at the bottom of the settings page.
常见问题
-
A member changed phones and is now locked out. What now?
-
Go to Settings – Prevent Account Sharing, enter the user’s ID or login name in the unbind tool, and clear their bindings. They log in again on the new device.
-
Yes. The device identifier lives in a browser cookie; clearing cookies, switching browsers, or incognito mode all register as new devices. This is the intended anti-sharing behavior. Legitimate users can be unbound by an admin.
-
Yes. One anonymous cookie named
eastacgu_device(random 32-character hex string, HttpOnly, one-year lifetime). It only distinguishes devices, contains no personal information, and is never sent to third parties. -
Will it slow down my site?
-
No. Heartbeat writes are throttled to once per 60 seconds per session; every check uses native WordPress sessions and user meta. No polling, no external requests.
评价
此插件暂无评价。
贡献者及开发者
更新日志
1.2.1
- Removed the Author URI header (connection to the site is restricted for some regions, which triggered a review error)
- Renamed all function/class/option/menu prefixes from
pas_to the uniqueeastacgu_prefix (previous prefix was too short and risked conflicts) - Added automatic migration of settings, device bindings, and device cookies from versions 1.2.0 and earlier
1.2.0
- Renamed to a distinctive name and slug: east115 Account Guard / east115-account-guard
- Removed load_plugin_textdomain() — translations auto-load for WordPress.org-hosted plugins since WP 4.6
1.1.0
- Added internationalization (i18n) — all strings translatable
- Added uninstall cleanup (uninstall.php)
- Added plugin header metadata
1.0.0
- Initial release: kick-oldest, device binding limit, concurrent denial, heartbeat detection, admin exemption, admin unbind tool