How to Log Out All WordPress Users After a Hack

How to log out all WordPress users after a hack

If your WordPress site has been compromised, forcing every active session to end is one of the first containment steps.

This guide explains how to log out all WordPress users after a hack, why it works, and what to do next to keep attackers from coming back.

Why logging out users matters after a compromise

WordPress stores authenticated sessions through login cookies and session tokens.

If an attacker stole a password, copied a browser session, or exploited a vulnerable plugin, they may remain logged in until those tokens expire or are invalidated.

Logging out all users immediately helps you:

• Invalidate stolen authentication cookies
• Force every administrator, editor, and subscriber to re-authenticate
• Reduce the chance of an attacker moving laterally inside the dashboard
• Buy time while you reset passwords and clean malware

Fastest ways to log out all WordPress users

There is no single built-in “log out everyone” button in WordPress core, but there are reliable methods that achieve the same result.

The best option depends on whether you still have admin access and how urgently you need to cut off sessions.

1. Change the WordPress security salts in wp-config.php

Updating the authentication unique keys and salts in wp-config.php is one of the most effective ways to invalidate all login sessions at once.

WordPress uses these values to generate secure cookies, so replacing them breaks existing authenticated sessions.

To do this safely:

1. Generate new salts from the official WordPress secret-key generator.
2. Open wp-config.php on your server.
3. Replace the existing AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY, and their matching salts.
4. Save the file and clear any server-side cache if applicable.

After this change, all users will need to sign in again.

This method is especially useful because it works even if you cannot identify which account was compromised.

2. Reset all user passwords

Password resets do not always invalidate every active session instantly, but they are still essential after a hack.

If the attacker reused a stolen password, changing it prevents future logins with the old credentials.

Use WordPress admin tools to force resets for:

• Administrators
• Editors
• Authors
• Any account that was active during the incident

If you cannot trust admin access, reset passwords directly in the database or through your hosting control panel.

Pair this with salt rotation for stronger session invalidation.

3. Remove all sessions from the database

WordPress stores session tokens in the user meta table.

Advanced users or developers can remove active sessions directly from the database to force logouts.

This approach is useful when you want precise control and have database access through phpMyAdmin, Adminer, or WP-CLI.

Common options include:

• Deleting session-related user meta for affected accounts
• Using WP-CLI to update or reset authentication state
• Removing all logged-in browser sessions from the site’s user records

This method should be used carefully.

Back up the database before making changes, and verify table prefixes if your installation does not use the default wp_.

4. Use a security plugin to force logout

Several WordPress security plugins provide session management features, including the ability to terminate existing logins, limit concurrent sessions, or force reauthentication after suspicious activity.

Plugins from vendors such as Wordfence, Solid Security, and Sucuri may offer tools that make incident response faster.

Look for features like:

• Session invalidation
• Two-factor authentication enforcement
• Admin user lockdown
• Login activity logs

If you already had one installed before the hack, check whether the plugin itself is compromised before relying on it.

If not, it can still be helpful during cleanup.

Which method should you choose first?

If you need the quickest and broadest protection, rotate the WordPress salts first.

That invalidates every logged-in session across the site and is usually the most reliable response when you are unsure how the breach happened.

A practical response order is:

1. Take the site offline or place it in maintenance mode if necessary.
2. Change the security salts in wp-config.php.
3. Reset passwords for all privileged users.
4. Review and terminate suspicious sessions.
5. Audit plugins, themes, and admin accounts for persistence mechanisms.

What happens to logged-in users after logout?

Once sessions are invalidated, users will typically be redirected to the login screen the next time they refresh, click a new page, or try to save content.

Unsaved changes in the editor may be lost, so communicate clearly with legitimate users if the site is still serving visitors or staff.

In a business environment, notify stakeholders that the forced logout is a security measure.

Tell them to use fresh passwords and avoid reusing credentials from other services.

How to verify the attacker is really out

Logging out users is only one part of regaining control.

You should also verify that no unauthorized sessions, accounts, or backdoors remain.

• Review the Users screen for unknown administrators
• Check recent logins and IP addresses in security logs
• Scan plugins and themes for file changes
• Inspect .htaccess, wp-config.php, and core files for tampering
• Search for rogue admin-level plugins or hidden PHP files in wp-content

If you find malicious code, remove it from a clean backup or fresh WordPress core download.

Then repeat the logout process after cleanup, because an attacker may have planted another access path.

Prevent the same problem from happening again

After an incident, focus on reducing the chance that a stolen session or password can be reused.

WordPress security is strongest when authentication, patching, and monitoring all work together.

Harden logins and access

• Enable two-factor authentication for all administrator accounts
• Use strong, unique passwords stored in a password manager
• Limit administrator accounts to trusted users only
• Remove inactive accounts and stale contributors

Keep WordPress components updated

Most compromises start with outdated software.

Regularly update WordPress core, themes, and plugins, and delete anything you do not actively use.

Vulnerabilities in plugin code are one of the most common entry points for attackers.

Improve monitoring and recovery

• Maintain offsite backups with tested restore points
• Log authentication activity and file changes
• Set alerts for new admin creation or plugin installation
• Use a web application firewall such as Cloudflare or a managed security service

When to get hosting support or a security professional involved

If you cannot confirm that the malware is gone, or if the attacker keeps regaining access after password changes and salt rotation, contact your hosting provider and a WordPress security specialist.

Persistent reinfection often means there is a server-level compromise, a hidden cron job, or an infected backup.

Ask your host whether they can help with:

• Forcing a full account logout
• Rotating server credentials
• Restoring from a known-clean backup
• Checking for unauthorized SSH, FTP, or database access

In many cases, the fastest fix is a clean restore combined with immediate session invalidation and credential rotation.

Key actions to take right away

To log out all WordPress users after a hack, rotate your authentication salts, reset privileged passwords, and check for malicious persistence.

Those three steps remove active access, protect against reused credentials, and give you a clean starting point for the rest of your incident response.