Really destroy all PHP sessions on server

Solution 1:

We ran through the same issue and we decided to create a maintenance page. As the code verifies that the user is logged in, we built up a code in the login verification process that checks if the maintenance mode is on, forcing all users to log in again.

We risk to have users that are idle at that moment. In these cases, we used the information stored in the Session Cookie, forcing session closure to all users with a timestamp anterior to the one in which the maintenance mode. Instead of the timestamp you could use any custom data that is stored in the cookie (user group, user role, user id) to be more precise and focus on a specific range of users.