Description

ARS Vigilo Sessions records every user login and logout on your site and surfaces that information in an easy-to-read admin dashboard. Features include:

Last login, first login, and total login count per user, shown on the Users list and on each user’s profile screen.
Full session history with login/logout time, duration, IP address, browser, and operating system.
Optional IP geolocation (city, region, country, and map view of recent logins).
Optional idle-timeout auto-logout, with a configurable warning before forced logout.
“Currently active users” widget on the dashboard.
CSV export of session history.
REST API endpoints for integrating session data with other tools.
Scheduled daily cleanup of old session records, with a configurable retention period.

Privacy notice

This plugin stores IP addresses, browser/OS strings, and (if geolocation is enabled) approximate location data tied to user accounts, in order to provide its tracking features. Site owners should disclose this in their privacy policy. All of this data is permanently removed when the plugin is deleted (see “Data removal” below), unless you opt out.

Third-party services

IP geolocation is off by default. If you turn it on in ARS Vigilo Sessions > Settings, the plugin sends a visitor’s login IP address to one of the following external services in order to look up an approximate location:

ip-api.com — used automatically when no API key is configured. See their terms of use.
ipinfo.io — used when you supply an ipinfo.io access token in Settings. See their privacy policy.
ip-geolocation.io — used when you supply an ip-geolocation.io API key in Settings. See their privacy policy.

No other data (page views, form submissions, content, etc.) is ever sent off-site, and no lookup occurs unless geolocation is explicitly enabled.

Credits

This plugin bundles the following third-party libraries:

Font Awesome Free 6.5.2 (solid icon set only) — icons under CC BY 4.0, fonts under SIL OFL 1.1, code under MIT. See assets/vendor/fontawesome/LICENSE.txt.
Leaflet 1.9.4 — BSD 2-Clause License. See assets/vendor/leaflet/LICENSE.txt.

Installation

Upload the ars-vigilo-sessions folder to the /wp-content/plugins/ directory, or install the zip file directly through the Plugins screen in WordPress.
Activate the plugin through the ‘Plugins’ screen in WordPress.
Go to ARS Vigilo Sessions in the admin menu to configure settings (idle timeout, geolocation, IP/browser tracking, retention period).

FAQ

Does deactivating the plugin delete my data?

No. Deactivating only stops tracking and clears the scheduled cleanup cron event. Your session history, settings, and user meta remain intact so you can safely re-activate later without losing data.

Does deleting the plugin delete my data?

Yes, by default. When you delete the plugin from the Plugins screen, it automatically removes:

The custom database table that stores session history.
All plugin settings/options.
All per-user meta fields it created (last login, login count, last IP, last browser, etc).
Any scheduled cron events.
On multisite networks, the same cleanup runs for every site.

If you want to keep this data even after deleting the plugin (for example, to re-install later), add this line to your wp-config.php before deleting:

define( 'ULLT_KEEP_DATA_ON_UNINSTALL', true );

Does this plugin slow down my site?

Session/activity tracking only runs for logged-in users. Geolocation lookups are cached per user so they don’t run on every request, and old session rows are pruned automatically based on your configured retention period.

Reviews

arjitsri September 14, 2026

My website kept getting anonymous logins , this plugin helped me keep track of all the logins made onto my site. Thanks for solving the problem. Highly recommended.

Read all 1 review

Contributors & Developers

“ARS Vigilo Sessions” is open source software. The following people have contributed to this plugin.

arjitsri

Translate “ARS Vigilo Sessions” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

1.1.0

Renamed the plugin from “Login Pulse” to “ARS Vigilo Sessions” (new slug: ars-vigilo-sessions). Updated the plugin header, text domain, translation template, and all user-facing admin menu/page titles accordingly. Internal option names, database table, and function/hook prefixes (ullt_) are unchanged, so no data migration is needed.

3.5.0

Renamed the plugin from “User Last Login Tracker” to “Login Pulse” (new slug: login-pulse) to resolve a name-similarity concern raised during the WordPress.org plugin review. Updated the plugin header, text domain, translation template, and all user-facing admin menu/page titles accordingly. Internal option names, database table, and function/hook prefixes (ullt_) are unchanged, so no data migration is needed.

3.4.7

Fixed placement of 4 translators: comments in the suspicious-login email builder — they must sit on the line immediately above the __() call itself, not merely above the enclosing sprintf().

3.4.6

Replaced all date() calls that build stored/displayed timestamps with gmdate() to avoid runtime-timezone-dependent output.
Added missing translators: comments and switched to numbered placeholders on all remaining translatable strings that use sprintf()/printf().
Added a justified suppression for fopen()/fclose() on php://output in the CSV export (a PHP output stream, not a filesystem path, so WP_Filesystem doesn’t apply).
Rewrote uninstall.php so its cleanup logic runs inside a function, scoping its working variables locally instead of leaving them as unprefixed globals; deduplicated the single-site/multisite cleanup into one function.
Documented, with justified suppressions, the remaining static-analysis false positives on the Sessions page’s dynamically-built $where clause (its placeholder/argument counts can’t be evaluated statically, but are correct at runtime).

3.4.5

Moved the session-expiry modal’s inline <style> block to wp_add_inline_style().
Sanitized the raw HTTP_USER_AGENT header before storing or parsing it, and consistently ran wp_unslash() before sanitize_text_field() on all $_GET/$_POST/$_REQUEST reads.
Sanitized the fallback nonce value read directly from $_POST before passing it to wp_verify_nonce().
Removed the now-unnecessary load_plugin_textdomain() call (WordPress.org has auto-loaded translations for hosted plugins since WP 4.6).

3.4.4

Fixed all escaping errors flagged by the WordPress.org Plugin Check tool: every _e() call now uses esc_html_e()/esc_attr_e(), and remaining raw output (URLs, translated strings with embedded markup, numeric values) is now properly escaped with esc_url(), esc_html(), wp_kses_post(), or absint().
Rewrote the Sessions page’s list/count queries so they are always run through $wpdb->prepare() unconditionally, removing the conditionally-prepared query that Plugin Check flagged as an unescaped database parameter.
Added missing translators: comments and switched to numbered (%1$s, %2$d, …) placeholders for all translatable strings with more than one placeholder.
Bumped “Tested up to” to 7.1.

3.4.3

Bundled Font Awesome (solid icon set) and Leaflet locally instead of loading them from a third-party CDN, so no visitor or admin data is ever sent to an external host just to render an icon or a map.
Removed a debug field that echoed the submitted security token back in a failed AJAX response.
Cleaned up plugin metadata (version numbers, headers) ahead of the WordPress.org directory submission.

3.4.1

Added uninstall routine that fully removes plugin data (database table, options, user meta, and cron events) when the plugin is deleted.
Added directory-listing protection files.
Added this readme.