Control Panel Session Expiration
Go to System → Settings → System
Two related settings on this page control how long an administrator stays signed in to the control panel: Control Panel Session Expiration and Keep Long Session.
Control Panel Session Expiration
Control Panel Session Expiration sets the amount of time, in minutes, that can pass without activity before you are automatically signed out of the control panel. This helps protect your account from unauthorized access if the admin panel is left unattended.
A related PHP session lifetime is configured on your server and can override this setting. The Control Panel Session Expiration value cannot exceed the server's session.gc_maxlifetime directive (you can check this value in PHPinfo). To ensure proper session management, keep the Control Panel Session Expiration time less than or equal to the session.gc_maxlifetime value.
Keep Long Session
Keep Long Session controls whether the control panel makes periodic background requests while an admin page is open in your browser. These background requests check for new message notifications and system alerts.
Because the background requests count as activity, they keep your admin session active while a control panel tab stays open, even when you are not clicking anything.
Keep Long Session on (default): the control panel periodically refreshes notifications and system checks in the background. Your session stays active as long as a control panel tab is open, so the inactivity timeout above effectively does not apply while that tab remains open.
Keep Long Session off: no background requests are made. The session then follows a strict idle timeout and expires after the Control Panel Session Expiration time with no activity.
Turn Keep Long Session off if you want the inactivity timeout to be enforced strictly, for example, on shared or public computers. After you change this setting, you may see a one-time prompt to sign in again.