---
title: WordPress account sharing prevention
description: WordPress has no native account sharing protection. Install the Rupt plugin to detect and stop account and password sharing on your membership site, courses, and WooCommerce store.
navigation:
  title: WordPress
---

# WordPress account sharing prevention with Rupt

WordPress lets one login sign in from anywhere, as many times as it likes. Nothing in core, WooCommerce, or the usual membership plugins tracks the devices behind an account, so a password handed to a friend looks the same as a member on their laptop.

The Rupt plugin fills that gap. Install it, paste your client ID, and Rupt evaluates every page view, login, and registration on your site. When one of your policies fires, Rupt challenges the session and signs the device out.

This guide assumes you've already chosen Rupt and want to wire it into WordPress. For the background on why account sharing happens and how detection works, see [Account sharing prevention](/docs/v3/guides/account-sharing-prevention).

## Step 1: Install the plugin

Search for **Rupt** on the plugins page of your WordPress admin (`/wp-admin/plugin-install.php`), install it, and activate it.

To install it manually instead:

1. Download <a href="/wordpress/plugin/rupt.zip" target="_blank">rupt.zip</a>.
2. Go to `/wp-admin/plugin-install.php` and click **Upload plugin**.
3. Choose the file you downloaded, install it, and activate it.

## Step 2: Add your client ID

Go to **Settings → Rupt** and paste the client ID from your [Rupt dashboard](https://app.rupt.dev).

Use a production client ID on a live site. A development client ID works for testing, but its data stays separate from production.

The other settings are optional:

| Setting                   | What it does                                                                                                                   |
| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
| **API domain**            | Point Rupt traffic at your own domain instead of `ap3.rupt.dev`. See [Proxy setup](/docs/v3/advanced/proxy-setup).             |
| **After logout URL**      | Where a signed-out device lands. A signup or pricing page turns a sign-out into an upgrade prompt. Defaults to your home page. |
| **Phone number meta key** | The user meta key holding a phone number, if your site stores one. Rupt uses it to reach the account owner during a challenge. |
| **Evaluate logins**       | Run a `login` evaluation on the first page a user loads after signing in. On by default.                                       |
| **Evaluate signups**      | Run a `signup` evaluation on the first page a newly registered user loads. On by default.                                      |

Once the client ID is saved, the plugin sends the signed-in user's ID, email, display name, roles, and optional phone number with every evaluation. Nothing else to wire up.

## Step 3: Configure your policies

Policies are what actually catch sharing. Without at least one policy, the plugin runs but never challenges anyone.

A policy has a trigger (the event it runs on) and a verdict. In your [policies dashboard](https://app.rupt.dev/policies), add a policy on the `access` trigger that challenges when it sees concurrent sessions or too many devices. The [Account sharing prevention](/docs/v3/guides/account-sharing-prevention) guide has the exact policies to start from.

Because the plugin also evaluates logins and signups, the same client ID covers more than sharing:

- The `login` trigger catches [account takeovers](/docs/v3/guides/account-takeover-prevention), where a stranger signs into a real member's account.
- The `signup` trigger catches [fake accounts](/docs/v3/guides/fake-account-detection), where one person registers a stream of throwaway logins.

Set the challenge success URL to your signup or offer page so the extra viewer can start their own subscription.

## Step 4: Evaluate your own actions (optional)

Anything specific to your site (a purchase, a download, a course completion) can run through Rupt too.

From PHP, queue an evaluation and it runs on the next page the user loads:

```php
add_action('woocommerce_thankyou', function ($order_id) {
  rupt_evaluate('purchase', ['metadata' => ['order_id' => $order_id]]);
});
```

From JavaScript, run one immediately:

```js
window.rupt.evaluate("purchase", { metadata: { order_id: "1234" } });
```

Both return an evaluation you can write policies against, on a trigger named after the action. See [Actions](/docs/v3/concepts/actions).

## How the pieces fit

The plugin never decides anything on its own. It reports what happened on your site and lets your policies decide.

<!-- prettier-ignore-start -->
::MermaidDiagram
---
code: |
  sequenceDiagram
    actor U as Member
    participant W as WordPress
    participant R as Rupt
    U->>W: Signs in
    W->>R: evaluate login (user, email, phone, device signals)
    U->>W: Loads a protected page
    W->>R: evaluate access
    R-->>W: Challenge (a policy fired)
    W-->>U: Hosted challenge
    R->>W: Sign the other device out
    W-->>U: Redirected to the after logout URL
---
::
<!-- prettier-ignore-end -->

## Frequently asked questions

**Does WordPress prevent password sharing?**
No. WordPress has no native account sharing or password sharing protection, and neither do WooCommerce or the common membership plugins. You add it by installing the Rupt plugin, which recognizes the devices behind each account and challenges the ones your policies flag.

**Do I have to change my theme or login form?**
No. The plugin reads the signed-in WordPress user on its own and hooks into WordPress's own login and registration events.

**Does it work with WooCommerce, MemberPress, or LearnDash?**
Yes. Anything that creates a real WordPress user and signs it in is covered.

**Does it work with a page cache?**
Yes. The plugin sets `DONOTCACHEPAGE` on the pages it runs on, which every major caching plugin honors, and most caches skip signed-in users anyway.

**Where does a signed-out device end up?**
At the **After logout URL** in **Settings → Rupt**, or your home page if you leave it empty.

## Related

- [Account sharing prevention](/docs/v3/guides/account-sharing-prevention)
- [Access protection](/docs/v3/fundamentals/access-protection)
- [Login protection](/docs/v3/fundamentals/login-protection)
- [Signup protection](/docs/v3/fundamentals/signup-protection)
- [Challenge flow](/docs/v3/challenge-flow)