Set WordPress user session expiration (hard, upper) limits.

set_session_limits.php

// Set session expiration limits in seconds.
add_filter('auth_cookie_expiration', 'session_expiration_filter', 99, 3);
function session_expiration_filter($seconds, $user_id, $remember){

    //if "remember me" is checked;
    if ( $remember ) {
        //WP defaults to 2 weeks (14*24*60*60);
        $expiration = 60; //UPDATE HERE;
    } else {
        //WP defaults to 48 hrs/2 days (2*24*60*60);
        $expiration = 60; //UPDATE HERE;
    }
    return $expiration;
}