Hi Markus,

When checking to see who's online, every member registered on my laptop shows as being online - rather than the member/s actually logged in. Is there a way to change this to show those members actually logged in?

You may be confusing "Recently Active" with "Currently Online". The first simply lists members by the date of their last activity, while the second additionally filters them against the "is online" limit (Limit by: Online in the builder).

You can configure the online criteria that under Online limit (min)" at Admin CP > Users > Manage Users at the bottom of the page. Your site is currently set at 300 min, and the iWiccle default is 15 min.

Users can control whether they want to be shown in the "Currently Online" lists (as well as the display of the Online now! text in their profile portal) under a switch at My Settings.

If some of the above doesn't work as expected, let me know and I'll look into it. I haven't tested this particular feature all that extensively to be honest.

Ok, that all makes sense.

I thought that online limit was when a user would be logged out so I set it at 300. I'll change that back to 15.

We don't currently have auto-logout --- I haven't seen the need for it, it's a bit over the top unless we're talking online banking or other critical applications like a domain control panel or the such, where substantial damage can be done by illegitimate account access. Your session ends and you are logged out in any case when you browser is closed, unless you choose "remember me" when you log in.

Speaking of the auto-login feature; in case someone was wondering why they get logged out of their home PC account if they log in at another location, it's because the login cookie that's in charge of remembering you is embedded with a unique hash smashed together with your password hash that gets reset every time you log in.

This is a useful security measure in the event that you for example logged in at an internet cafe and accidentally chosen "remember me"; then, instead of you account being open there indefinitely for anyone to have fun with, the cookie becomes invalid as soon as you log in again from somewhere else. (Happens to me all the time when I'm logging in at office and then at my laptop. I can look into coding a dual location login hash cookie setup if this bugs someone too much.)