I am a .NET developer but I also administer all of our corporate websites, which are all Wordpress. I inherited the sites from someone who is no longer at my company.

My company recently spent a bunch of money on a security audit by consultants and they found the following issues regarding login/cookie and how they work in Wordpress.

-User session cookies are not secure -session validation is not destroyed and is still active when a user logs out -session cookie includes the username in it

Is there any way do fix these issues?

1 Answer 1


The functions that generate, validate and clear auth cookies are all pluggable (meaning you can write your own versions of them). Just note that some of them may need to return something specific (like the user ID).

One note: the cookies should, in fact, be destroyed when you log out. If they're not being destroyed, something is probably wrong. And "User session cookies are not secure" is pretty vague--you should ask for more input before you can conceptualize how to resolve this.

To solve your "session cookie includes username" problem, you could encrypt/obfuscate the value somehow before setting it, and decrypt it before running it through the auth check.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.