1. Overview

Session Length is extension wich manage timed subscriptions with custom start and expiration dates, and automatic access removal when a subscription expires. Limit authenticated frontend sessions to a duration of your choice for specific user groups or individual users, and control how frequently users can log in.

Session Length limits authenticated frontend sessions to an absolute duration. It displays a persistent countdown and logs the user out at zero. Server-side checks enforce expiry even when JavaScript is disabled, interrupted, or modified. See Admin settings for better understanding.

The extension also includes a standalone timed-subscription manager. Administrators create one subscription record per Joomla user, select how it starts, and control which Joomla groups require active subscriptions.

2. Package architecture

Customer sites install only pkg_sessionlength_vVERSION.zip. Do not ask customers to install constituent ZIP files separately.

3. Requirements and scope

4. Installation and initial setup

1. Use the built installer dist/pkg_sessionlength_v1.1.5.zip.
2. Open System → Install → Extensions.
3. Upload the package ZIP.
4. Confirm these extensions exist under System → Manage → Extensions: component, system plugin, installer plugin, and module.
5. Open System → Manage → Plugins → System - Session Length.
6. Configure duration rules before publishing the countdown module.

Updating an existing installation

Upload the newer parent package over the existing version. The package uses Joomla's upgrade method and preserves configuration and subscription data. Upgrades from the old exemption-only subscription setting preserve that behavior by migrating it to Excluded mode.

5. Session duration rules

Session duration and subscription duration are separate concepts. The session rule controls how long one login lasts. The subscription record controls the period during which the user may access the frontend.

Rule priority

1. Individual user rule.
2. Matching Joomla user-group rule.
3. Default duration when the user is directly assigned to a selected default-duration group.

Every rule contains a duration and warning threshold in minutes. If several group rules match, choose either the shortest or longest matching rule. The warning threshold is taken from the same winning rule.

6. Login frequency limit

The optional frequency limiter restricts successful frontend logins within a rolling number of hours. For example, a maximum of 3 logins over 24 hours permits three successful public-site logins in any rolling 24-hour period.

• Administrator logins are not counted.
• Selected Joomla groups can be exempt.
• Counts are stored in the database and are not reset by clearing browser storage.
• When blocked, Joomla ends the attempted login and shows an approximate wait time.

7. Standalone subscriptions

Open Components → Session Length Subscriptions. Each Joomla user may have one subscription record.

Recommended setup

1. Create a Joomla group such as Paid Subscribers.
2. Directly assign paid users to that group.
3. Create one subscription record for each user.
4. In the system plugin, select Included groups require a subscription.
5. Select Paid Subscribers.
6. Enable Require an active subscription only after records and groups are ready.

Access states

8. Included and Excluded group modes

Super Users and Joomla Administrator access remain excluded in both modes.

9. Subscription component fields

Duration calculation

• If both start and expiration are selected, their exact difference is stored internally in minutes.
• If expiration is empty, purchased days are multiplied by 1,440 minutes.
• Expiration must be later than start.
• Existing minute-based database records remain compatible and display as days in the form.

Extending a subscription

For a precise renewal date, edit Expires at. To calculate a new expiry from days, set the purchased days and clear Expires at before saving.

10. Countdown module

1. Open Content → Site Modules.
2. Create or open Session Length Countdown.
3. Select the template position, menu assignments, and registered access level.
4. Choose the light or dark theme and optionally change the label.
5. Publish the module.

The module renders nothing for guests. It uses the warning threshold selected by the active session rule. When subscription expiry occurs before session expiry, the earlier subscription deadline wins.

11. Protected automatic updates

The package registers this public update feed:

https://shop.topoweryou.com/files/updatesxml/sessionlength.xml

Customers enter their key under:

System → Manage → Plugins → Installer - Session Length Update Key

The installer plugin sends the key only when all of these match:

• Host: shop.topoweryou.com
• Component: com_vmupdatekeymanager
• Task: download.get
• Filename: pkg_sessionlength_vMAJOR.MINOR.PATCH.zip

The plugin converts /index.php to the canonical / endpoint before downloading, avoiding the host's HTTP 301 redirect that Joomla's installer does not follow in this path.

12. Security and operational notes

• Session expiry is enforced on the server, not only by the countdown.
• Refreshes and extra browser tabs do not reset the deadline.
• The update key is restricted to the expected host, endpoint, and package filename.
• Protected ZIP files belong under the Safe Path, outside public web storage.
• Super Users and Administrator requests are excluded from subscription enforcement.

Joomla Shared Sessions

If Joomla Shared Sessions is enabled, a frontend logout can also invalidate the same browser's Administrator session. Keep Shared Sessions disabled when administrator continuity is important. Changing Joomla's Shared Sessions setting invalidates existing sessions.

13. Troubleshooting