WordPress Cookies and PHP Sessions Explained

WordPress uses cookies (small text files stored in the visitor’s browser) to manage logins, comments, and admin authentication, while PHP sessions (server-side data files) are rarely used by WordPress core but are common in plugins for temporary data like shopping carts or multi-step forms. This article explains how both mechanisms work, how they differ, and what you need to know to troubleshoot common issues.

What Are Cookies in WordPress?

Cookies are small pieces of data that a web server sends to a browser, which then stores them and sends them back with subsequent requests. WordPress sets several cookies depending on the user’s role and activity:

• WordPress logged-in cookies – e.g., wordpress_logged_in_* – keep you authenticated in the admin area and on the front end.
• WordPress auth cookies – e.g., wordpress_sec_* – secure the admin session and are only sent over HTTPS.
• Comment cookies – comment_author_* – remember a commenter’s name, email, and URL for the next time they comment.
• Settings cookies – e.g., wp-settings-* – store admin interface preferences like the color scheme or editor mode.

These cookies are set by the wp_set_auth_cookie() and wp_set_comment_cookies() functions. They are sent with every request to your domain, which is why they must be kept small and secure.

How PHP Sessions Work and Why WordPress Avoids Them

PHP sessions store data on the server, usually in files or a database, and identify the user with a session ID that is typically stored in a cookie (e.g., PHPSESSID). WordPress core deliberately does not use PHP sessions because they are not scalable in a shared hosting environment and can cause conflicts with caching plugins. Instead, WordPress uses its own authentication cookies that contain a hashed token, which is validated against a user’s session token stored in the wp_usermeta table.

Plugins like WooCommerce or WPForms may start PHP sessions for temporary data (e.g., cart contents or form submissions) but they often use WordPress’s own session handling or transients to avoid the pitfalls of native sessions.

How WordPress Authentication Cookies Work (The Details)

When you log in, WordPress creates two cookies: one for the front end (wordpress_logged_in_*) and one for the admin (wordpress_sec_*). Each cookie contains a username, an expiration timestamp, and a hash generated using a secret key defined in your wp-config.php. The hash includes the user’s password hash and a session token, so if the password changes, the cookie becomes invalid.

The admin cookie is only sent over HTTPS if you have configured WordPress to use SSL. The front-end cookie is sent over both HTTP and HTTPS, but it does not grant admin access. This separation is a security measure to prevent session hijacking.

Session tokens are stored in the database, allowing you to log out of all sessions (e.g., from the Users screen). This is a more secure approach than a simple expiration timestamp because it allows revocation.

Common Problems with Cookies and Sessions

Several issues can arise:

• “Cookies are blocked or not supportedâ€� error – This usually appears when the browser cannot store cookies for your domain, often due to third-party cookie blocking or a misconfigured COOKIE_DOMAIN constant.
• Being logged out unexpectedly – Often caused by an incorrect timezone or server time, or by the AUTH_KEY and AUTH_SALT values being changed (e.g., when moving the site).
• Session conflicts with caching – If a plugin uses PHP sessions and you have a page caching plugin, cached pages may be served to users with stale session data. This is why many caching plugins exclude pages that use sessions.
• “Cannot modify header informationâ€� warning – This happens when output is sent before PHP tries to set a session cookie, often due to whitespace in a plugin or theme file.

How to Fix Cookie and Session Issues

Here are practical steps to resolve common problems:

1. Check your wp-config.php for the COOKIE_DOMAIN constant – If it is set incorrectly (e.g., with www when the site is accessed without it), cookies will not be set. Remove or correct it.
2. Clear your browser cookies and cache – Sometimes stale cookies cause conflicts. Test in an incognito window to isolate the issue.
3. Verify server time and timezone – Go to Settings → General and ensure the timezone matches your server’s timezone. A mismatch can cause cookies to expire immediately.
4. Disable plugins that use PHP sessions – If the issue is session-related, deactivate all plugins and re-enable them one by one to find the culprit.
5. Update your secret keys – If you suspect a security issue, generate new AUTH_KEY and AUTH_SALT values. This will log out all users, which is a good security practice.

Security Best Practices for Cookies

To keep your cookies secure:

• Use HTTPS – Set the FORCE_SSL_ADMIN constant to true to ensure admin cookies are only sent over SSL.
• Set the httponly flag – WordPress does this by default for auth cookies, which prevents JavaScript from accessing them (reducing XSS risk).
• Use a security plugin – Many plugins can add the Secure flag to all cookies, ensuring they are only sent over HTTPS.
• Regularly change your secret keys – This invalidates all existing sessions, which is useful if you suspect a breach.

Alternatives to PHP Sessions in WordPress

Because native PHP sessions can cause problems, WordPress developers often use alternatives:

• Transients – A caching API that stores data in the database or object cache with an expiration time. Useful for temporary data like a “flashâ€� message.
• User meta – Store temporary data in the user’s meta table, but this is not ideal for anonymous users.
• Cookies – For small amounts of data that need to persist across visits, you can set your own cookies using setcookie().
• LocalStorage – For client-side data, but this is not sent to the server.

Frequently Asked Questions

Why does WordPress not use PHP sessions?

WordPress avoids PHP sessions because they are not scalable on shared hosting, can conflict with page caching, and require session management that is not compatible with the stateless nature of HTTP. Instead, WordPress uses its own cookie-based authentication with server-side session tokens stored in the database.

How do I clear WordPress cookies?

You can clear cookies in your browser settings, but to force all users to be logged out, you can change the secret keys in wp-config.php or use a plugin like “Force Reauthenticationâ€�. This is also useful after a security breach.

Why am I getting a “cookies are blocked� error in WordPress?

This error usually appears when your browser cannot store cookies for the site. Check that cookies are enabled, that you are not in incognito mode with third-party cookies blocked, and that the COOKIE_DOMAIN constant is correct.

What is the difference between a session and a cookie?

A cookie is stored on the client side (browser) and sent with every request. A session is stored on the server and identified by a session ID, which is often kept in a cookie. WordPress uses cookies for authentication and stores session tokens in the database, not in PHP session files.

How long do WordPress cookies last?

By default, auth cookies last for 2 days, or 14 days if you check “Remember Meâ€�. This is controlled by the auth_cookie_expiration filter, which you can modify in a plugin or theme.

Can I use PHP sessions in my plugin?

Yes, but it is not recommended because it can break with caching and may conflict with other plugins. If you must use sessions, start them only when needed and use a unique session name to avoid collisions.

Related

• Apple Mouse Not Scrolling? Fixes That Work
• Shoot for Eggs: Beginner Core Loop Guide
• Ninja Foodi Power Blender CB402: Trade-Offs to Know