Access control

Brief information on how access control works

What can be controlled

You can monitor which IP addresses users are accessing your course, marathon, webinar, etc., from and restrict them. You can block a specific address or a range of addresses (by mask). Alternatively, you can allow access only from certain IP addresses — for example, if your employees are in the office and you want to allow access only from there, denying access from home internet.

Additionally, you can control the number of concurrent sessions in a student’s account. If a student opens the platform and starts watching a video lesson on their phone, that counts as 1 active session. If, after some time (e.g., 15 minutes), the same student opens the same lesson on a laptop, it is counted as a second active session. There is no way to reliably determine whether it's the same person or a different one watching the video on the laptop. You can monitor and limit the number of active sessions — for example, by allowing 1 active session, you permit only 1 login to the account at a time, meaning the course can only be accessed from one device simultaneously. The same person from another device (or another person from a different device) won’t be able to watch lessons. More details on setting restrictions will be described below.

You can also control the number of devices used to log in. Device tracking is implemented via cookies, so if a student opens the course on one device using two different browsers, it will be counted as two different devices. More accurate tracking would require client permission to access MAC addresses, which most users won’t grant.

The check is performed each time the student interacts with the platform — logging in, opening the course, lessons, completing tasks, etc. — but not more often than once every 30 seconds. In the settings, you define the check interval, which is counted from the student’s last interaction with the platform.

What is the difference between simultaneous sessions and the number of devices?

When counting active sessions, only sessions that are currently online are considered — i.e., simultaneous access. When counting the number of devices, both online and offline sessions are included.

What happens if the student exceeds the allowed limit

In the access control settings, you specify what should happen if the limit is exceeded. Possible options:

Do nothing – in this case, you will only be able to track the limit breach in the contacts list.

Older session loses access – the student whose session is older will be logged out of the account. If they try to log in again, the other session will be automatically logged out. Additionally, you can set up a notification that the client will see.

Block the contact – the client will lose access to all products in their account, meaning they won’t be able to watch lessons or complete tasks. You can configure a notification that the client will see.

Access control and restriction settings

You can enable access control and restrictions in the Settings – Access Control menu.

Device Limit Restriction

This setting allows you to limit the number of devices a student can use to access your courses and materials.
As a reminder, a device is "counted" based on cookie records, meaning opening a course in different browsers on the same phone will be considered two different devices. If a student clears their cookies and accesses the course again in a previously used browser, it will also be counted as a new device. More accurate device identification would require access to the MAC address, which most users will not consent to share, so this method is not used.

You can specify the number of allowed devices and define the consequences of exceeding the limit:

• Do nothing – allows you to track limit violations without applying any restrictions to the student.
  
• Deny access from devices exceeding the limit – the user will not be able to access the course from any new devices beyond the allowed number.
  
• Block the contact – the contact will lose access to all products available in their account within your project. You can unblock them at any time.

We recommend editing the blocking message to include instructions on where the user should reach out if they do not understand why they were blocked or believe the block was unjustified.

You can determine this based on your audience — for example, how likely it is that your clients use multiple devices or primarily access courses via mobile phones — as well as whether you have your own support service capable of restoring access in case of a block, among other factors.

The Kwiga support team cannot unblock clients, so please ensure that your clients know how to contact you or your support team. We recommend including this contact information in the blocking message.

IP Restrictions

You can specify certain IP addresses from which access is allowed or add exceptions for specific IP addresses that should be denied access. This is most often useful for training employees who use static IPs or VPNs to connect to the work environment, or for strict control where your students can and are willing to share their IP addresses. In such cases, you must collect and add these IP addresses manually.

Simultaneous Account Logins

In this section, you can specify the number of simultaneous logins from different devices within a given period. In this setting, logging in from different browsers on the same device will count as separate sessions.
For example, if a student opens the course in Chrome and then wants to open it in Safari on the same phone, it will be counted as 2 simultaneous logins.

Alternatively, you can use the "Number of simultaneous logins with IP check" option, where in the above scenario (opening the course in two different browsers on the same phone), it will be recognized that both sessions originate from the same IP address. Technically, tracking by IP will allow for a more relaxed restriction.

Examples of simultaneous login settings (without IP tracking)

You want to allow only one active session per hour for your clients:

Or you assume that the same person will log in from both a phone and a laptop, and therefore allow 2 active sessions within 1 hour:

You can reduce the check period — for example, change the settings to allow 1 active session within 10 minutes:

After setting the limits, select the desired action.

Also, specify how many times exceeding the limit is allowed and what consequences will apply based on the number of violations.

This setting allows you to make the restrictions “softer” and gives you the ability to collect more information about students’ behavior. Possible consequences of exceeding the limit:

• Do nothing

• The oldest session will lose access – the oldest active session in the list will automatically be denied access.

• Close access for all old sessions that exceed the limit – all old sessions exceeding the initial limit (without exceptions) will be denied access.

• Block the contact – the contact will lose access to all products of your project that are available to them. You can unblock them at any time.

You define the period, the number of sessions, and the action to apply yourself, considering your audience (how likely it is that your clients use multiple devices or if they almost always study from a mobile phone), the presence of your own support service that can restore access for a client in case of blocking, and other factors.

Increasing the check period allows for stricter rules. For example: setting 1 session per 24 hours means that a student can only have 1 session within a day. However, if you reduce this value to 1 hour, then logging into the account at 8:00 a.m. and finishing a lesson at, say, 8:45, will allow the student to start a new session at 9:45 without restrictions.

Kwiga Support will not be able to unblock a client, so please make sure your clients know how to contact you or your support team. We recommend providing these contacts in the notification shown when the limit is exceeded.

Number of simultaneous logins with IP check

This setting allows you to limit the number of simultaneous logins by IP – i.e., specify the number of IP addresses allowed for simultaneous connection. For example, a student can use multiple different devices if all of them share one IP address (or 2 or more, depending on what is set in the configuration). A single IP can occur if a student uses one device with several browsers, or multiple devices connected to the same network, or if a connection through Proxy, VPN, etc. is set up.

Examples of simultaneous login settings with IP check

You want to allow simultaneous login from a single IP within 15 minutes:

You want to allow no more than 2 IP addresses within one hour:

After you set the limits, choose the desired action.

You determine the period, the number of sessions, and the action to apply on your own, taking into account your audience (how likely it is that your clients use multiple devices, or if they almost always study from a mobile phone), the availability of your own support service that can restore access for a client in case of blocking, and other factors.

Kwiga Support will not be able to unblock a client, so please make sure your clients know how to contact you or your support team. We recommend including these contacts in the notification shown when the limit is exceeded.

Additional

• Login log

• How to unblock a user