I am trying to set up a login system and Contact form for Fornt End Users of my Custom WP Theme. I need to create some Ajax Post method and Send the input values to server like Captcha and User Inputs values like captcha, name, phone, email, ... Now my question is, do I have to create PHP Session to secure unwanted form submission or passing the captcha value between two pages?

if so, is this a correct page template for a contact page and captcha page

 Template Name: Contact Page

the captcha.php



2 Answers 2


Yes, you can but you will get errors about the header already being sent unless you hook into init or admin_init (or elsewhere prior to the headers being sent). I haven't tested it, but you may be able to hook your session function into the send_headers action1 which seems like the most appropriate place since session is ultimately sending headers.

On a template page, I think it will work if you start the session before calling get_header().

Here is an example from a plugin I previously built.

Setting up the session:

// Must run session_start() during admin_init to use $_SESSION variables later

function register_session() {
      if( !session_id()
        && current_user_can( 'manage_options' )
        && current_user_can( 'client_tools' )  )

This is part of a function that is used to set the session variables where I needed them.

// Update notifications
add_action( 'admin_post_mmc_update_notification', 'mmc_update_notification' );

function mmc_update_notification() {
        //Check the nonce
        check_admin_referer( 'mmc_notification_nonce' );

        // Set a session variable
        if ( isset( $_POST[ 'client-manager-lname' ] ) )
            $_SESSION['client-manager-lname'] = $_POST['client-manager-lname'];


This allowed me to use these session variables on a sub menu page for this plugin like so:

//Define variables to be used in search results. Make sure each is set first.
if( isset($_SESSION['client-manager-lname'])
&& $_SESSION['client-manager-lname'] != '' ) {
$last_name = $_SESSION['client-manager-lname'];

You can unset session variables at the end of the script when it is no longer needed with unset ($_SESSION['varname']);. All session variables can be unset with session_unset(); which is a good idea to run right after starting a session if you need to ensure that you are setting fresh variables for each session without leftovers from prior sessions.

Destroy the session with session_destroy();.

I recommend reading PHP: session_unset - Manual.

Update: I looked a bit more closely at why you are considering using PHP sessions and saw Hybrid Web Dev's answer. There is an option to remember credentials when your user is logged in (authenticated) via wp_signon()2.

As stated, always use a wp_nonce_field()3 in your forms and verify it with wp_verify_nonce()4 in your form handling script.

I just happened upon a good article regarding Cookies and PHP Sessions in WordPress with an overview some cache and security related problems with relying on $_SESSION variables. Other Stuff Archives - WP Engine

All in all, it seems best to avoid PHP sessions in WordPress where possible. In some cases, it may be ideal to store temporary data via the Transient API5.

  • Thanks Raynal This is one of the best explanation about WordPress and PHP Session on the web! Thanks again
    – Suffii
    Nov 8, 2014 at 2:20
  • 1
    Transients are another way to have data persist, however there's a flaw with them. Wp tends to forget to kill some of the transients when they expire, and thus you end up with a DB full of useless transients. Nov 9, 2014 at 18:30
  • That's true. If get_transient() returns false then the transient either doesn't exist or is expired. You can use delete_transient() to remove expired transients and if no transient exists, it will do nothing.
    – iyrin
    Nov 9, 2014 at 18:37

Sessions are basically useful for having data persist between pages.

If you're using ajax calls, then you shouldn't need sessions at all, as you can easily pass parse/pass data on the fly, including other templates/files. On that note, WP has a built in ajax handling system. If you're unfamiliar with it, I'd suggest checking the WP codex.

As for securing unwanted submissions, you absolutely should ALWAYS be using nonces, in ADDITION to validating and sanitizing/checking EVERY single piece of user input. Using a whitelist vs blacklisting approach for validation will save you a lot of headaches and generally make life easier.

  • Thanks Hybrid Web Dev, I have just one more question here! how about passing variables like Captcha through PHP pages? Can you please let me know how to deal with those kind of variables?
    – Suffii
    Nov 8, 2014 at 0:27
  • You should be able to directly take the user input (ie the key they entered) and pass it back to whatever class, or program you use for validation. Nov 8, 2014 at 5:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.