PHP Code Log User Out After X Number Minutes of Inactivity

PHP How to Automatically Log a User Out After X Number Minutes of Inactivity Including Page Refresh so Logged Out HTML Shows After Logout

Home Short:

You can log a user out after x number of minutes of inactivity, ie no new page loads, using php alone but its also a good idea to let the user see they have been logged out when it happens which requires just a bit of Javascript.

First the Javascript code. This gets placed in the head section of the html code and it will be responsible for causing a page refreshed when the inactivity logout occurs. Although this is not absolutely required.

This code gets placed between the <head> and </head> tags at the top of your web page.

This php code gets placed at the very top of the page. Might be a good idea to put this code in a separate file ie sessionstart.php and call it into the beginning of the web page via include "path-to-sessionstart-file/session-start.php";.

# start the session
session_start();

# timeout value in seconds 60 sec = 1 min * number min (30)
 # change 30 to your desired timeout value. this value is also used 
 # in the meta http-equiv and javascript code above for
 # triggering the page refresh
$USER_timeoutval = (60 * 30);

# number of seconds buffer to add to elapsed time $elapsed_time
 # to take into account any delay between page refresh 
 # (http-equiv="refresh") and when this code runs
$buffer = 10;

# Ensure a session variable exists for tracking timestamp
if (!isset($_SESSION["last_timestamp"])) 
{
    $_SESSION["last_timestamp"] = time();
} 
else 
{
     # amount of time between now and the last page load
    $elapsed_time = (time() - $_SESSION["last_timestamp"]);

# Check if the timeout has been reached
    if (($elapsed_time + $buffer) > $USER_timeoutval) 
    {
        # destroy all session variable
        session_unset();
        session_destroy();
        $_SESSION = [];

$WP_serverErrJS = "alert('[server] You have been logged out due to inactivity.');";
    } 
    else 
    {
         # get a new session id for security
        session_regenerate_id(true);

# Update timestamp since the session is still valid
        $_SESSION["last_timestamp"] = time();
    }
}

# session variable which holds the boolean value of whether user
 # is logged in. should get set to true on successful user login
if (!isset($_SESSION["USER_loggedin"]))
{
    $_SESSION["USER_loggedin"] = false;
}

source code home