Logging Out All Web Users After a Security Event

Evolution CMS includes manager tools for clearing locks, but a different kind of maintenance question appears after incidents and critical updates: how do you force all website users to sign in again?

Why you might need this

• a compromised account or leaked session data
• a password policy reset
• a login flow update
• moving a site to a different authentication strategy

What “log everyone out” really means

For web users, logout usually means invalidating the session state that keeps them authenticated. Depending on the stack, that can involve:

• clearing server-side session storage
• rotating a session secret or cookie key
• removing persistent remember-me tokens
• forcing the login snippet or package to reject old sessions

If login is built with FormLister

FormLister may handle the login form, but the important part is still the underlying web-user session. The exact reset method depends on how the project stores login state.

Recommended operational approach

1. identify where web-user sessions are stored
2. invalidate or purge active sessions
3. clear application cache if the login flow caches user-specific output
4. notify users if they need to sign in again

There is no one-button universal “logout every web user” tool in every project, but the goal is clear: invalidate the active session layer, not just the content cache.