Session timeout: how analytics splits visits into sessions

What is a session timeout?

In web analytics, a session timeout is the period of inactivity after which an analytics tool ends the current session. If a visitor does nothing for longer than the timeout and then comes back, their next action starts a new session. The common default is 30 minutes.

The term has a second meaning in security and web applications: the time after which a logged-in user is signed out for inactivity. That is covered briefly at the end; most of this page is about analytics.

How the timeout splits activity into sessions

One visitor's events on a single morning (sample):

How many sessions is that?

The same behavior produces one, three or five sessions. Every session-based metric moves with it: sessions, pages per session, average session duration, bounce rate and session conversion rate. With a 30-minute timeout the sign-up happens in session 3, and the session that "converted" came from whatever source started it, not necessarily the blog post that brought the visitor in.

Other rules that end a session

Besides inactivity, tools commonly start a new session when:

• A maximum length is reached (for example 24 hours).
• The day changes at midnight in the reporting time zone (some tools).
• The traffic source changes, such as arriving again from a different campaign or search engine mid-session (some tools).

These rules differ between products, which is one reason session counts rarely match across tools; see why analytics tools show different numbers.

Choosing a timeout

• 30 minutes suits most content and commerce sites and keeps numbers comparable with common defaults.
• Longer (60 minutes or more) fits apps and tools where people leave a tab open while working, watch long videos or read long documentation.
• Shorter rarely helps; it inflates session counts and deflates duration.

Whatever you choose, keep it stable. Changing the timeout breaks period-over-period comparisons of every session metric.

Session timeout and engagement metrics

Timeouts interact with how duration is measured. Many tools calculate session duration as the time between the first and last event, so a single-page visit with no later event has a duration of zero, and time spent reading the last page is not counted unless the tool sends a leave or heartbeat signal. That is why "engaged" definitions, such as at least 10 seconds or two pageviews, are often more stable than raw duration; see engaged session.

Session timeout in security

In application security, a session timeout signs a user out after a period of inactivity (idle timeout) or after a fixed total time (absolute timeout), so an unattended device cannot be used to act as that person. OWASP recommends shorter idle timeouts for high-value applications (such as 2–5 minutes) and longer ones for low-risk applications (15–30 minutes). This is unrelated to analytics sessions: being logged out does not end an analytics session, and an analytics timeout does not log anyone out.

In TapCub

TapCub's default session rules are 30 minutes of inactivity and a 24-hour maximum. Midnight and ad-parameter changes do not split a session unless you turn that on; arriving mid-session from a different external source does split it by default. You can change the rules in project settings; edits apply only to data collected afterward, so mark the change on your charts. Session duration is the time from the first to the last event, and a session counts as engaged at 10 seconds, two pageviews or a key goal event.

Sources

• Google Analytics Help. How a web session is defined in Universal Analytics and About Analytics sessions (GA4).
• OWASP. Session Management Cheat Sheet: session expiration.
• TapCub documentation. Web metric definitions.