WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am a .NET developer but I also administer all of our corporate websites, which are all Wordpress. I inherited the sites from someone who is no longer at my company.

My company recently spent a bunch of money on a security audit by consultants and they found the following issues regarding login/cookie and how they work in Wordpress.

-User session cookies are not secure -session validation is not destroyed and is still active when a user logs out -session cookie includes the username in it

Is there any way do fix these issues?

share|improve this question

The functions that generate, validate and clear auth cookies are all pluggable (meaning you can write your own versions of them). Just note that some of them may need to return something specific (like the user ID).

One note: the cookies should, in fact, be destroyed when you log out. If they're not being destroyed, something is probably wrong. And "User session cookies are not secure" is pretty vague--you should ask for more input before you can conceptualize how to resolve this.

To solve your "session cookie includes username" problem, you could encrypt/obfuscate the value somehow before setting it, and decrypt it before running it through the auth check.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.