Title: ARS Vigilo Sessions
Author: arjitsri
Published: <strong>September 14, 2026</strong>
Last modified: September 14, 2026

---

Search plugins

![](https://ps.w.org/ars-vigilo-sessions/assets/Banner-772x250.png?rev=3694759)

![](https://ps.w.org/ars-vigilo-sessions/assets/icon.svg?rev=3694662)

# ARS Vigilo Sessions

 By [arjitsri](https://profiles.wordpress.org/arjitsri/)

[Download](https://downloads.wordpress.org/plugin/ars-vigilo-sessions.1.1.0.zip)

 * [Details](https://wordpress.org/plugins/ars-vigilo-sessions/#description)
 * [Reviews](https://wordpress.org/plugins/ars-vigilo-sessions/#reviews)
 *  [Installation](https://wordpress.org/plugins/ars-vigilo-sessions/#installation)
 * [Development](https://wordpress.org/plugins/ars-vigilo-sessions/#developers)

 [Support](https://wordpress.org/support/plugin/ars-vigilo-sessions/)

## Description

ARS Vigilo Sessions records every user login and logout on your site and surfaces
that information in an easy-to-read admin dashboard. Features include:

 * Last login, first login, and total login count per user, shown on the Users list
   and on each user’s profile screen.
 * Full session history with login/logout time, duration, IP address, browser, and
   operating system.
 * Optional IP geolocation (city, region, country, and map view of recent logins).
 * Optional idle-timeout auto-logout, with a configurable warning before forced 
   logout.
 * “Currently active users” widget on the dashboard.
 * CSV export of session history.
 * REST API endpoints for integrating session data with other tools.
 * Scheduled daily cleanup of old session records, with a configurable retention
   period.

#### Privacy notice

This plugin stores IP addresses, browser/OS strings, and (if geolocation is enabled)
approximate location data tied to user accounts, in order to provide its tracking
features. Site owners should disclose this in their privacy policy. All of this 
data is permanently removed when the plugin is deleted (see “Data removal” below),
unless you opt out.

#### Third-party services

IP geolocation is off by default. If you turn it on in **ARS Vigilo Sessions > Settings**,
the plugin sends a visitor’s login IP address to one of the following external services
in order to look up an approximate location:

 * [ip-api.com](https://ip-api.com/) — used automatically when no API key is configured.
   See their [terms of use](https://ip-api.com/docs/legal).
 * [ipinfo.io](https://ipinfo.io/) — used when you supply an ipinfo.io access token
   in Settings. See their [privacy policy](https://ipinfo.io/privacy-policy).
 * [ip-geolocation.io](https://ip-geolocation.io/) — used when you supply an ip-
   geolocation.io API key in Settings. See their [privacy policy](https://ip-geolocation.io/privacy-policy).

No other data (page views, form submissions, content, etc.) is ever sent off-site,
and no lookup occurs unless geolocation is explicitly enabled.

### Credits

This plugin bundles the following third-party libraries:

 * [Font Awesome Free](https://fontawesome.com/) 6.5.2 (solid icon set only) — icons
   under CC BY 4.0, fonts under SIL OFL 1.1, code under MIT. See `assets/vendor/
   fontawesome/LICENSE.txt`.
 * [Leaflet](https://leafletjs.com/) 1.9.4 — BSD 2-Clause License. See `assets/vendor/
   leaflet/LICENSE.txt`.

## Installation

 1. Upload the `ars-vigilo-sessions` folder to the `/wp-content/plugins/` directory,
    or install the zip file directly through the Plugins screen in WordPress.
 2. Activate the plugin through the ‘Plugins’ screen in WordPress.
 3. Go to **ARS Vigilo Sessions** in the admin menu to configure settings (idle timeout,
    geolocation, IP/browser tracking, retention period).

## FAQ

### Does deactivating the plugin delete my data?

No. Deactivating only stops tracking and clears the scheduled cleanup cron event.
Your session history, settings, and user meta remain intact so you can safely re-
activate later without losing data.

### Does deleting the plugin delete my data?

Yes, by default. When you delete the plugin from the Plugins screen, it automatically
removes:

 * The custom database table that stores session history.
 * All plugin settings/options.
 * All per-user meta fields it created (last login, login count, last IP, last browser,
   etc).
 * Any scheduled cron events.
 * On multisite networks, the same cleanup runs for every site.

If you want to keep this data even after deleting the plugin (for example, to re-
install later), add this line to your `wp-config.php` before deleting:

    ```
    define( 'ULLT_KEEP_DATA_ON_UNINSTALL', true );
    ```

### Does this plugin slow down my site?

Session/activity tracking only runs for logged-in users. Geolocation lookups are
cached per user so they don’t run on every request, and old session rows are pruned
automatically based on your configured retention period.

## Reviews

There are no reviews for this plugin.

## Contributors & Developers

“ARS Vigilo Sessions” is open source software. The following people have contributed
to this plugin.

Contributors

 *   [ arjitsri ](https://profiles.wordpress.org/arjitsri/)

[Translate “ARS Vigilo Sessions” into your language.](https://translate.wordpress.org/projects/wp-plugins/ars-vigilo-sessions)

### Interested in development?

[Browse the code](https://plugins.trac.wordpress.org/browser/ars-vigilo-sessions/),
check out the [SVN repository](https://plugins.svn.wordpress.org/ars-vigilo-sessions/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/ars-vigilo-sessions/)
by [RSS](https://plugins.trac.wordpress.org/log/ars-vigilo-sessions/?limit=100&mode=stop_on_copy&format=rss).

## Changelog

#### 1.1.0

 * Renamed the plugin from “Login Pulse” to “ARS Vigilo Sessions” (new slug: `ars-
   vigilo-sessions`). Updated the plugin header, text domain, translation template,
   and all user-facing admin menu/page titles accordingly. Internal option names,
   database table, and function/hook prefixes (`ullt_`) are unchanged, so no data
   migration is needed.

#### 3.5.0

 * Renamed the plugin from “User Last Login Tracker” to “Login Pulse” (new slug:`
   login-pulse`) to resolve a name-similarity concern raised during the WordPress.
   org plugin review. Updated the plugin header, text domain, translation template,
   and all user-facing admin menu/page titles accordingly. Internal option names,
   database table, and function/hook prefixes (`ullt_`) are unchanged, so no data
   migration is needed.

#### 3.4.7

 * Fixed placement of 4 `translators:` comments in the suspicious-login email builder—
   they must sit on the line immediately above the `__()` call itself, not merely
   above the enclosing `sprintf()`.

#### 3.4.6

 * Replaced all `date()` calls that build stored/displayed timestamps with `gmdate()`
   to avoid runtime-timezone-dependent output.
 * Added missing `translators:` comments and switched to numbered placeholders on
   all remaining translatable strings that use `sprintf()`/`printf()`.
 * Added a justified suppression for `fopen()`/`fclose()` on `php://output` in the
   CSV export (a PHP output stream, not a filesystem path, so `WP_Filesystem` doesn’t
   apply).
 * Rewrote `uninstall.php` so its cleanup logic runs inside a function, scoping 
   its working variables locally instead of leaving them as unprefixed globals; 
   deduplicated the single-site/multisite cleanup into one function.
 * Documented, with justified suppressions, the remaining static-analysis false 
   positives on the Sessions page’s dynamically-built `$where` clause (its placeholder/
   argument counts can’t be evaluated statically, but are correct at runtime).

#### 3.4.5

 * Moved the session-expiry modal’s inline `<style>` block to `wp_add_inline_style()`.
 * Sanitized the raw `HTTP_USER_AGENT` header before storing or parsing it, and 
   consistently ran `wp_unslash()` before `sanitize_text_field()` on all `$_GET`/`
   $_POST`/`$_REQUEST` reads.
 * Sanitized the fallback nonce value read directly from `$_POST` before passing
   it to `wp_verify_nonce()`.
 * Removed the now-unnecessary `load_plugin_textdomain()` call (WordPress.org has
   auto-loaded translations for hosted plugins since WP 4.6).

#### 3.4.4

 * Fixed all escaping errors flagged by the WordPress.org Plugin Check tool: every`
   _e()` call now uses `esc_html_e()`/`esc_attr_e()`, and remaining raw output (
   URLs, translated strings with embedded markup, numeric values) is now properly
   escaped with `esc_url()`, `esc_html()`, `wp_kses_post()`, or `absint()`.
 * Rewrote the Sessions page’s list/count queries so they are always run through`
   $wpdb->prepare()` unconditionally, removing the conditionally-prepared query 
   that Plugin Check flagged as an unescaped database parameter.
 * Added missing `translators:` comments and switched to numbered (`%1$s`, `%2$d`,…)
   placeholders for all translatable strings with more than one placeholder.
 * Bumped “Tested up to” to 7.1.

#### 3.4.3

 * Bundled Font Awesome (solid icon set) and Leaflet locally instead of loading 
   them from a third-party CDN, so no visitor or admin data is ever sent to an external
   host just to render an icon or a map.
 * Removed a debug field that echoed the submitted security token back in a failed
   AJAX response.
 * Cleaned up plugin metadata (version numbers, headers) ahead of the WordPress.
   org directory submission.

#### 3.4.1

 * Added uninstall routine that fully removes plugin data (database table, options,
   user meta, and cron events) when the plugin is deleted.
 * Added directory-listing protection files.
 * Added this readme.

## Meta

 *  Version **1.1.0**
 *  Last updated **16 hours ago**
 *  Active installations **Fewer than 10**
 *  WordPress version ** 5.8 or higher **
 *  Tested up to **7.1**
 *  PHP version ** 7.4 or higher **
 * Tags
 * [last login](https://wordpress.org/plugins/tags/last-login/)[login](https://wordpress.org/plugins/tags/login/)
   [security](https://wordpress.org/plugins/tags/security/)[session tracking](https://wordpress.org/plugins/tags/session-tracking/)
   [user activity](https://wordpress.org/plugins/tags/user-activity/)
 *  [Advanced View](https://wordpress.org/plugins/ars-vigilo-sessions/advanced/)

## Ratings

No reviews have been submitted yet.

[Your review](https://wordpress.org/support/plugin/ars-vigilo-sessions/reviews/#new-post)

[See all reviews](https://wordpress.org/support/plugin/ars-vigilo-sessions/reviews/)

## Contributors

 *   [ arjitsri ](https://profiles.wordpress.org/arjitsri/)

## Support

Got something to say? Need help?

 [View support forum](https://wordpress.org/support/plugin/ars-vigilo-sessions/)