Something very strange is happening. I am using sessions on my wordpress website and for some reason, a session stays active until I update the page in the Wordpress website.

I have build a template for a login page and a page that will be reached after succesfully logging in. The following occurs:

First I have updated the pages in Wordpress

  • I log in as John and i reach the secure page with John's information.
  • I log out as John and log in as Pete, but i still see John's information. Even if i log in from a completely different pc. Also, if I directly go to the secure page, without logging in, I still see John's information!
  • I update the secure page again in Wordpress and all information on the secure page is gone again and I can log in normally again.

How is this possible? Why is the session information of one user stored on the page for everyone to see? And why does it only disappear when I update the page in the Wordpress dashboard?

code of secured page:

<div id="primary">
    <div id="content" role="main">
        $periodarray = array('januari', 'februari', 'maart', 'april', 'mei', 'juni', 'juli', 'augustus', 'september', 'oktober', 'november', 'december');
        if(date("d") > 10){$maand1 = date("m");}else{$maand1 = date("m") - 1;}
        if(isset($_GET['periode'])){$periode = $_GET['periode'];}else{$periode=$periodarray[$maand1-1];}
        if(isset($_GET['jaar'])){$jaar = $_GET['jaar'];}else{$jaar = date("Y");}
        if(isset($_SESSION['rhptarief'])){$rhptarief = $_SESSION['rhptarief'];}
        if (isset($_SESSION['username'])) 
            $hdmsg = "Welkom ".$_SESSION['name'];?><body>

        <?php }else{?>
        U bent niet ingelogd.
        <input type="button" style="background-color:#F90;" value="Inloggen" onClick="LogIn()">
        <?php } ?>
    </div><!-- #content -->
</div><!-- #primary -->

EDIT: It only seems to be happening with Internet Explorer (I use 11) and not with Google Chrome.

  • Do you have any caching plugins active? Have you tried turning them off? – Otto Apr 1 '15 at 21:52
  • How do I know if a plugin is a caching plugin? – Alex de Jong Apr 1 '15 at 22:00
  • I think you need to start session and destroy session when you login and when you log out. This answer may help you. – cybmeta Apr 1 '15 at 22:41
  • After the comment of Otto, I found WP Super Cache as an active plugin: This plugin generates static html files from your dynamic WordPress blog. After a html file is generated your webserver will serve that file instead of processing the comparatively heavier and more expensive WordPress PHP scripts. I deactivated it, but it doesn't work. I also found out that if I change the php file of the secure script (e.g. echo 'test' on the top of the page), the changes will show in Google Chrome imediatly, but in IE they will only show if I also update the page in Wordpress – Alex de Jong Apr 1 '15 at 22:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.