I personally think that 15 minutes is a bit long, but I haven't changed it on any of my forums. I hate getting excited that a particular person might be on only to find out that they left 14 minutes ago.
vBulletin Options -> vBulletin Options -> Cookie and HTTP Header Options -> Cookie Timeout. I have mine set for thirty minutes because when you want people to create long quality posts, it is very discouraging to be logged out in the middle of writing such a post. Not everyone checks Remember Me. Fifteen minutes is often too short for someone to write, format and contribute a worthwhile topic. I don't really care what the "Who's Online" says. It can never be completely accurate on the web anyway.
Ok Ive set it to 1800 now some of my members have been complaining about getting kicked off after writing a long post, so hopefully that shall stop now
1900 seconds... which is about 31 seconds. Don't know why I set it quite to that exact second amount.
ok..so does this actually mean when they close their page they stay online or no? I never did understand this 100%...
Actually sessions are deleted from the database after an hour of inactivity. The system will stop showing them as active after the cookie timeout passes. Technically, you cannot stay logged into a web page as far as the server is concerned. The web is designed to be stateless. However you can use smoke and mirrors or rather cookies and sessions to make it appear that you are continually logged in. The way vBulletin does this is it checks your cookies and the session record in the database on every page load. If they match it logs you in. If they don't and you don't have "Remember Me" checked, it asks you to log in again. With the sessions, a user will show up in the What's Going On box for as long as your cookie timeout is. The timer starts only after their last page load. Each page load restarts the timer and logs the user in simultaneously.
From what I understand is that yes, from the time the user is inactive on the forum, it will keep them 'logged in' for the set amount of time until the cookies expire, unless the person manually logs out. Have I got that right?
I have mine set to 1200 seconds (20 minutes). For security purposes our server disconnects the user if they have remained inactive (haven't connected - such as refresh the page, submit post, etc) in 20 minutes. This seems to be a best practice among those that I have talked to in web security so I adopted it. HTH, RR
