Change the WordPress Auto-Logout Time (auth_cookie_expiration)

This article is a localized edition of the Japanese original. Read the Japanese original

If you stay logged in to WordPress, you are logged out automatically after a certain time. You can change that time with the auth_cookie_expiration filter. This article explains the default times and how they work, code to lengthen or shorten them, and how to log out people who are already logged in right now.

Default login expiration

The expiration and how the cookie is stored depend on whether "Remember Me" was checked on the login screen (based on the implementation of wp_set_auth_cookie() in WordPress core).

Three points are worth keeping in mind.

• The expiration is counted from the time you logged in. Working in the admin does not extend it. WordPress core has no "log out after a period of inactivity" feature.
• If the box is not checked, closing the browser deletes the cookie and logs you out even before the expiration (depending on the browser's "continue where you left off" setting, it may survive).
• The expiration is fixed at login. Changing the setting does not affect people who are already logged in; the new time applies from their next login.

Where to put the code

We recommend writing the code below in a PHP file (for example login-expiration.php) in the wp-content/mu-plugins/ folder. If you put it in the theme's functions.php, the setting is lost when you switch themes. Create the mu-plugins folder if it doesn't exist. Files in it are loaded without any activation step.

Change the login expiration

The auth_cookie_expiration filter receives the expiration in seconds ($length), the user ID ($user_id) and whether "Remember Me" was checked ($remember), and returns a number of seconds.

<?php
/**
 * Plugin Name: Change the login expiration
 */
add_filter( 'auth_cookie_expiration', function ( $length, $user_id, $remember ) {
    if ( $remember ) {
        return 30 * DAY_IN_SECONDS; // "Remember Me" checked: 30 days
    }
    return 8 * HOUR_IN_SECONDS;     // Not checked: 8 hours
}, 10, 3 );

• DAY_IN_SECONDS (86400) and HOUR_IN_SECONDS (3600) are constants defined by WordPress.
• If you forget the fourth argument 3 to add_filter(), $user_id and $remember are not passed and you get an error.
• After saving, log out and log back in once to apply the new time.

Shorten it for administrators only

Because a hijacked administrator account does the most damage, some sites shorten the login expiration for administrators. This example sets administrators (users with manage_options) to 2 hours and leaves everyone else at the default.

<?php
add_filter( 'auth_cookie_expiration', function ( $length, $user_id, $remember ) {
    if ( user_can( $user_id, 'manage_options' ) ) {
        return 2 * HOUR_IN_SECONDS; // Administrators: 2 hours, regardless of "Remember Me"
    }
    return $length; // Everyone else: the default (2 or 14 days)
}, 10, 3 );

This filter runs during the login process, so use user_can(), which takes a user ID, rather than current_user_can(), which checks the user who is currently logged in.

If you make it too short, the login will expire while you are writing a post. When the login expires with the admin open, a small login window appears on top of the screen, and after logging back in you can continue working. The block editor autosaves your changes, but when writing a long post it is safer to click "Save draft" often.

Don’t let “Remember Me” make a difference

If you don't want the time to depend on the checkbox, return the same number of seconds without looking at $remember. The checkbox remains but no longer affects the time.

<?php
add_filter( 'auth_cookie_expiration', function ( $length, $user_id, $remember ) {
    return 12 * HOUR_IN_SECONDS; // 12 hours whether or not the box is checked
}, 10, 3 );

If you don't want to show the checkbox at all, add a style to the login screen to hide it. The checkbox sits in a paragraph with the class forgetmenot.

<?php
add_action( 'login_head', function () {
    echo '<style>.forgetmenot { display: none; }</style>';
} );

This only hides it visually; the time is still decided by the filter above. Use the two together. Note that without the box checked, the cookie is deleted when the browser closes, so hiding the checkbox means users log in again every time they close the browser.

Log out people who are logged in now

Shortening the expiration does not affect people who are already logged in. To cut them off immediately, end their sessions with one of the methods below.

In the admin, open the user's edit screen under "Users" and click the button in the "Sessions" section.

• On your own profile the button reads "Log Out Everywhere Else" and ends every login except the browser you are using.
• When an administrator opens another user, the button reads "Log Out Everywhere" and ends all of that user's logins.

Where WP-CLI is available, you can use these commands.

# List the active sessions of user admin (login time, expiration, IP address)
wp user session list admin

# End all sessions of user admin
wp user session destroy admin --all

# Log out every user at once (regenerates the authentication keys in wp-config.php)
wp config shuffle-salts

wp config shuffle-salts replaces values such as AUTH_KEY in wp-config.php, so everyone, including you, is logged out. You need permission to write to wp-config.php. Use it when you suspect an account has been hijacked.

If you want “log out after inactivity”

WordPress core has no setting to log users out after a period of inactivity. The WordPress.org plugin directory has plugins with this feature (for example Inactive Logout). If you install one, check its last-updated date and whether it has been tested with your current WordPress version first (as of November 2026).

Things to watch out for

• The longer the expiration, the greater the risk if a computer is shared or a cookie is stolen. Don't make it too long for administrator and editor accounts.
• Security plugins sometimes have their own setting for the login expiration. They use the same auth_cookie_expiration filter, so which value wins depends on the order they run in. Keep the setting in one place.
• Problems such as being logged out too quickly, or not on time, are sometimes caused by URL settings or cookie issues rather than by the expiration. How to track down the cause is covered in "Why your WordPress login keeps expiring and how to fix it".

Summary

• The default login expiration is 2 days after login (14 days with "Remember Me" checked)
• It is counted from the login time and is not extended by activity
• Return a number of seconds from the auth_cookie_expiration filter to change it; it applies from the next login
• To shorten it for administrators only, check user_can( $user_id, 'manage_options' )
• Log out people already logged in with the button on the profile screen or wp user session destroy, or everyone with wp config shuffle-salts

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)