I have my Drupal website whose admin account is shared. But I want to limit the multiple logins, that is, only one should be able to login at a time. I have already used Session Limit Module. This works for non-administrator accounts, but not for admin account.

How can I prevent multiple administrators logins?

  • They really shouldn't be using a single account.
    – Kevin
    Commented Oct 5, 2016 at 11:49

2 Answers 2


Session Limit allows to put restriction on session based on user role, it could be admin role also, with an exception that it does not restrict user with uid 1 which is kind of rescue point in case you misconfigure the module.

I would say instead of finding any module or building any custom solution which can put restriction on uid 1, you use different account with admin role which this/any module can handle gracefully.

As a thumb rule I don't put any restriction on uid 1.

If you see the code of session_limit.module line 248

function session_limit_init() {
  global $user;
  if ($user->uid > 1 && !isset($_SESSION['session_limit'])) {

    if (_session_limit_bypass()) {
      // Bypass the session limitation on this page callback.

It clearly shows uid 1 is left intentionally.


While it's better not to allow UID 1 login for other admin users, instead creating separate administrator user accounts, if you really want to restrict UID 1 to a single session, it's possible.

You could basically copy session_limit_init to a custom module (with a dependency on the session_limit module), preserving the existing logic, and tweak it to apply only to UID 1. The UID 1 user will need one of the roles configured in the session limit module, e.g "administrator"

For example:

 * Implements hook_init().
 * This is a copy of session_limit_init
 * It extends the default session_limit functionality to apply to UID 1
function MYMODULE_init() {
  global $user;
  // The only difference is $user->id == 1 instead of $user->uid > 1
  if ($user->uid == 1 && !isset($_SESSION['session_limit'])) {

    if (_session_limit_bypass()) {
      // Bypass the session limitation on this page callback.

    $query = db_select('sessions', 's')
      // Use distict so that HTTP and HTTPS sessions
      // are considered a single session.
      ->fields('s', array('sid'))
      ->condition('s.uid', $user->uid);

    if (module_exists('masquerade') && variable_get('session_limit_masquerade_ignore', FALSE)) {
      $query->leftJoin('masquerade', 'm', 's.uid = m.uid_as AND s.sid = m.sid');

    $active_sessions = $query->countQuery()->execute()->fetchField();
    $max_sessions = session_limit_user_max_sessions();

    if (!empty($max_sessions) && $active_sessions > $max_sessions) {
      session_limit_invoke_session_limit(session_id(), 'collision');
    else {
      // force checking this twice as there's a race condition around session creation.
      // see issue #1176412
      if (!isset($_SESSION['session_limit_checkonce'])) {
        $_SESSION['session_limit_checkonce'] = TRUE;
      else {
        // mark session as verified to bypass this in future.
        $_SESSION['session_limit'] = TRUE;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.