How to Enable Stay Logged In in WordPress

What Is the Stay Logged In feature?

By default, WordPress’s “Remember Me” checkbox extends the auth cookie to 14 days. The Stay Logged In feature extends this to 30 days (configurable).

The difference: 14 days vs 30 days may not seem significant, but for users who frequently visit your site, it means fewer login interruptions.

Why You Need It

The default 14-day auth cookie is fine for most sites, but for some use cases, a longer duration is better:

• Frequent visitors: Users who visit the site daily benefit from fewer login interruptions
• Internal tools: For sites used as internal tools (e.g., a CRM, project management), users don’t want to log in every 2 weeks
• Trusted environments: For sites in trusted environments (e.g., company intranets), longer sessions are appropriate
• E-commerce admin: For store admins, frequent logins are disruptive

For most public-facing sites, 14 days is appropriate. For internal tools or trusted environments, 30 days is a small improvement.

Trade-offs vs standard 14-day session

Extending the session has trade-offs:

• Lost device: A 30-day session is still valid after the device is lost or stolen
• Compromised credentials: If a user’s password is compromised, the attacker has up to 30 days of access
• Compliance: Some regulations require shorter session durations for sensitive data
• User experience: For users who share devices, the longer session is a risk

For most sites, the trade-offs favor the standard 14-day session.

How to Enable Stay Logged In in WordPress

1. 1
   Step 1

   Navigate to Settings

   Click into the Classic Monks plugin settings in your WordPress dashboard.

2. 2
   Step 2

   Go to the Security Tab

   Click on the Security menu, then click the Stay Logged In subtab.

3. 3
   Step 3

   Enable Stay Logged In

   Scroll to Enable Stay Logged In and toggle on.

   

4. 4
   Step 4

   Save Changes

   Click Save Changes.

5. 5
   Step 5

   Test

   Log in with the “Remember Me” checkbox checked. Close the browser. Wait 15 days (or manually advance the system clock). Log in again. The session should still be valid.

Configuration Options

The session duration is set to 30 days by default. To customize, adjust the session duration in the plugin settings under Security > Stay Logged In.

What Gets Affected

• The auth cookie duration: extended to 30 days
• The user experience: fewer login interruptions
• The security: slightly reduced (longer window for compromised credentials)
• The session management: still works the same way (login, logout, expire)

What Does NOT Get Affected

• The user roles: not affected
• The WordPress admin: not affected (after login)
• The REST API: not affected
• The application passwords: not affected

Advanced Options (Developers)

This feature registers 2 WordPress hooks in stay-logged-in.php:

Actions:

• login_footer calls cm_remember_me_checked() (Auto-checks Remember Me checkbox)

Filters:

• auth_cookie_expiration calls cm_stay_logged_in() (Extends cookie expiration time)

// Hooked in stay-logged-in.php
add_filter( 'auth_cookie_expiration', 'cm_stay_logged_in' );

The feature modifies WordPress behavior by registering or removing hooks. Disabling it reverses those changes and WordPress returns to its default behavior.

Troubleshooting

4 problems and how to fix each one.