Does anyone know if it's possible to log everyone out of ExpressionEngine to force everyone to login again on their next visit?

Due to the Heartbleed bug, I have noticed a few other sites/services doing something similar.


Deleting everything in the exp_sessions table, and everything under system/expressionengine/cache should be sufficient to log out all users.

I'd also recommend changing $config['encryption_key'] in system/expressionengine/config/config.php if you have that set.

  • I'd also add that while resetting user sessions is a good idea (since it's low-impact on your users), forcing users to reset their passwords is probably over the top, unless you are dealing with particularly sensitive information (or believe you may have been actively exploited with heartbleed, rather than just general caution). Obviously this is your call to make though. Apr 11 '14 at 0:21
  • Thanks Adrian. We're thinking of just sending an email advising users to change passwords rather than forcing them to reset. Our hosting companies have secured our servers and don't believe there have been any exploits. :) Apr 11 '14 at 7:40

I haven't tested this but you could probably start by clearing out the exp_sessions table.

However, I'm not certain this is going to help with regards to the Heartbleed issue. Has your server been patched? Was it vulnerable? Do you log users in via https?

  • Hi. The server has been patched and our SSL Certificate has been re-generated. We log users in via https and they make purchases via https as well. We're going to get users to change passwords as well. Apr 10 '14 at 11:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.