I build a custom plugin that make me able to use SESSION to passe parameters from a page to others pages without GET parameters.

This works very well.

Basically i start my session like this :

add_action('init', 'myStartSession', 1);
function myStartSession() {
if (session_status() == PHP_SESSION_NONE) {


And then set session variable like this in different part of the site

$_SESSION['key']  = "value";

And finish like this

add_action('wp_logout', 'myEndSession');

function myEndSession() {

Problem : If i go on Tools > Health Site, i have 2 errors :

  • An active PHP session was detected
  • API REST Error : cURL error 28: Operation timed out after 10001 milliseconds with 0 bytes received (http_request_failed)

If i comment my start session line i don't have the 2 errors more. But i need this session. How can i make it different ?


1 Answer 1


The only way to make this go away is to not use PHP sessions and use cookies directly instead.

PHP sessions are fundamentally incompatible with a lot of page caching and CDN mechanisms e.g. cloudflare, Varnish, or full page caching plugins such as batcache or WP Supercache. PHP Sessions are also turned off and disabled on a lot of WP hosts e.g. WP Engine.

You cannot rely on PHP sessions in WordPress, especially if you want to write portable code or sell themes/plugins.

PHP Sessions also can't be used to bypass cookies as the session ID itself is stored in a cookie. There are also security consequences as the user can change this ID in the browser dev tools to retrieve the information of other users. This is much harder with cookie based sessions. In PHP sessions the data is stored server side so I only need to know the right ID for the application to fetch the other persons session details. In cookie based sessions though the data is sent in the HTTP request and is not persisted in server memory, so I need to steal that cookie from your machine to impersonate you which is easier said than done.

Instead use standard cookies. e.g. setcookie( 'key', 'value' );. This is what WordPress itself does, it's also how a lot of e-commerce sites implement carts ( think for a moment, how do sites that aren't built in PHP do it? PHP sessions are unnecessary ).

  • I'm currently thinking about switching to http only cookies from php sessions (which is pretty similar, I know), but I'm confused about your point saying that 'users can change the ID in the dev tools to retrieve the info of other users'. Isn't the exact same also the case for session cookies, by simply copy pasting the authentication hash of a stolen cookie for your cookie in the dev tool?
    – DevelJoe
    Jun 14, 2022 at 10:11
  • The difference is that you have to steal that cookie in order to do that, but with PHP sessions the ID is stored in a cookie you have access to. If I were to do that to impersonate you I would need either physical access to your machine, or to insert and run code that steals the data, otherwise the cookie based session would be invalid and my attempt would fail. Listening in with a MITM attack would only work on non-HTTPS connections, and require me to be on the same network as you
    – Tom J Nowell
    Jun 14, 2022 at 13:08
  • Let us continue this discussion in chat.
    – Tom J Nowell
    Jun 14, 2022 at 15:07
  • thanks again for your time and help! After our chat and some more research, I though that it might fit good into this question to post how someone could potentially fight the issue with the facilitated brute-forcing of PHP session IDs: You can actually override PHP's default behaviour of generating session IDs with your own way of generating a CSPRN; you may check this and this.
    – DevelJoe
    Jun 14, 2022 at 18:50
  • If you however use both a web and a mobile app based on the same backend, it may still be wiser and/or faster to implement your own session logic all together, as I can hardly imagine a case where mobile apps would use PHP sessions (I'm mentioning this because the question asks about REST APIs).
    – DevelJoe
    Jun 14, 2022 at 18:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.