Navigation
View as Markdown

WordPress account sharing prevention with Rupt

WordPress lets one login sign in from anywhere, as many times as it likes. Nothing in core, WooCommerce, or the usual membership plugins tracks the devices behind an account, so a password handed to a friend looks the same as a member on their laptop.

The Rupt plugin fills that gap. Install it, paste your client ID, and Rupt evaluates every page view, login, and registration on your site. When one of your policies fires, Rupt challenges the session and signs the device out.

This guide assumes you've already chosen Rupt and want to wire it into WordPress. For the background on why account sharing happens and how detection works, see Account sharing prevention.

Step 1: Install the plugin

Search for Rupt on the plugins page of your WordPress admin (/wp-admin/plugin-install.php), install it, and activate it.

To install it manually instead:

  1. Download rupt.zip.
  2. Go to /wp-admin/plugin-install.php and click Upload plugin.
  3. Choose the file you downloaded, install it, and activate it.

Step 2: Add your client ID

Go to Settings → Rupt and paste the client ID from your Rupt dashboard.

Use a production client ID on a live site. A development client ID works for testing, but its data stays separate from production.

The other settings are optional:

SettingWhat it does
API domainPoint Rupt traffic at your own domain instead of ap3.rupt.dev. See Proxy setup.
After logout URLWhere a signed-out device lands. A signup or pricing page turns a sign-out into an upgrade prompt. Defaults to your home page.
Phone number meta keyThe user meta key holding a phone number, if your site stores one. Rupt uses it to reach the account owner during a challenge.
Evaluate loginsRun a login evaluation on the first page a user loads after signing in. On by default.
Evaluate signupsRun a signup evaluation on the first page a newly registered user loads. On by default.

Once the client ID is saved, the plugin sends the signed-in user's ID, email, display name, roles, and optional phone number with every evaluation. Nothing else to wire up.

Step 3: Configure your policies

Policies are what actually catch sharing. Without at least one policy, the plugin runs but never challenges anyone.

A policy has a trigger (the event it runs on) and a verdict. In your policies dashboard, add a policy on the access trigger that challenges when it sees concurrent sessions or too many devices. The Account sharing prevention guide has the exact policies to start from.

Because the plugin also evaluates logins and signups, the same client ID covers more than sharing:

  • The login trigger catches account takeovers, where a stranger signs into a real member's account.
  • The signup trigger catches fake accounts, where one person registers a stream of throwaway logins.

Set the challenge success URL to your signup or offer page so the extra viewer can start their own subscription.

Step 4: Evaluate your own actions (optional)

Anything specific to your site (a purchase, a download, a course completion) can run through Rupt too.

From PHP, queue an evaluation and it runs on the next page the user loads:

add_action('woocommerce_thankyou', function ($order_id) {
  rupt_evaluate('purchase', ['metadata' => ['order_id' => $order_id]]);
});

From JavaScript, run one immediately:

JavaScript
window.rupt.evaluate("purchase", { metadata: { order_id: "1234" } });

Both return an evaluation you can write policies against, on a trigger named after the action. See Actions.

How the pieces fit

The plugin never decides anything on its own. It reports what happened on your site and lets your policies decide.

Frequently asked questions

Does WordPress prevent password sharing? No. WordPress has no native account sharing or password sharing protection, and neither do WooCommerce or the common membership plugins. You add it by installing the Rupt plugin, which recognizes the devices behind each account and challenges the ones your policies flag.

Do I have to change my theme or login form? No. The plugin reads the signed-in WordPress user on its own and hooks into WordPress's own login and registration events.

Does it work with WooCommerce, MemberPress, or LearnDash? Yes. Anything that creates a real WordPress user and signs it in is covered.

Does it work with a page cache? Yes. The plugin sets DONOTCACHEPAGE on the pages it runs on, which every major caching plugin honors, and most caches skip signed-in users anyway.

Where does a signed-out device end up? At the After logout URL in Settings → Rupt, or your home page if you leave it empty.

Related