FAIR

Federated and Independent Repositories

SameSite Cookies

Plugin Banner

SameSite Cookies

by Ayesh Karunaratne

Download
Description

This plugin adds the “SameSite” cookie flag to WordPress’s authentication cookies. On supported browsers (all current IE, Edge, Chrome, and Firefox), this can effectively prevent all Cross-Site Request Forgery attacks throughout your WordPress site.

SameSite cookie flag support was added to PHP on version 7.3, but this plugin ships with a workaround to support all PHP versions WordPress supports.

There is no administrative UI provided: Activate this plugin, and you are all set!

You can configure the SameSite flag value from your WordPress configuration file. You cna pick a value from Lax (default), Strict, or None. You can read about SameSite cookies here.

To configure the SameSite flag value, edit your WordPress configuration file (wp-config.php), and add the following lines right above /** Sets up WordPress vars and included files. */.

define( 'WP_SAMESITE_COOKIE', 'Lax' ); // Pick from 'Lax', 'Strict', or 'None'.

Note that only the authentication cookies are affected. Regular cookies that your installed plugins set will not be affected, nor provide any meaningful value with SameSite flags.

  1. Install this plugin as you would with any other plugin.
  2. Enable it.
  3. There is no third step – From this point afterward, authentication cookies your WordPress site uses will contain SameSite flag, and you will be protected from CSRF attacks.

If you find this plugin useful, I’d appreciate you leaving a review on the plugin page.

  1. Browser response containing the SameSite attribute in Setcookie headers.

    Browser response containing the SameSite attribute in Setcookie headers.

The plugin doesn’t work !?!?

Yeah, probably. This plugin uses what’s called “pluggable functions” supported in WordPress to replace wp_set_auth_cookie function.
This means that any other plugin that tampers with the login cookie parameters will override this plugin, and this plugin may not even get a chance to do what it does.

How do I test if the plugin works

Go to the Login page of your WordPress site, and open your browser’s development tools. Inspect the HTTP POST request made by the browser when you submit the login form. The response headers for Setcookie response headers must contain Samesite=Lax (or the configured value) if the plugin is working.

Note that cookies apart from the authentication cookies are not handled by this plugin, nor it makes sense to add SameSite attribute to them.

See the screenshot as well.

Do I need to have PHP 7.3 or later?

No. PHP 7.3 officially added SameSite cookie support, but this plugin comes with a polyfill to extend support to all previous PHP versions.

Is WordPress vulnerable to CSRF attacks without this plugin?

Without SameSite cookie, WordPress core and third party plugins must implement their own CSRF checks, which can be overlooked, intentionally ignored, or sometimes not even have thought about, which can be the case for contributed plugin. This plugin attempts to solve this with different take and complement existing solutions.

2024 → This plugin DOES work.

By Fer (ferfactory) on May 14, 2024

Looks like nobody read the FAQ:

The plugin doesn’t work !?!?

Yeah, probably. This plugin uses what’s called “pluggable functions” supported in WordPress to replace wp_set_auth_cookie function.
This means that any other plugin that tampers with the login cookie parameters will override this plugin, and this plugin may not even get a chance to do what it does.

In my case, the issue was with the plugin WPS Hide Login. Disable that other plugin and this plugin worked correctly.

EDIT: In case you still want to change the login URL, use the plugin Admin login URL Change.

The plugin doesn't work

By tranhoang on July 16, 2021

I don't know why the Author created this plugin, It does not work, please remove it from the plugin library

Wasted two days on this

By Rab Nawaz (rnawaz02) on September 15, 2020

It does not work

it's works

By ramazan12345 on April 5, 2020

Chrome was showing an error from the developer console. Errors disappeared when I installed this plugin. The plugin is working and problem-free. thank you

It could work...

By pypmaker on March 4, 2020

It sorted out my problem. And created another - I can't log into my site with this plugin installed! Unfortunately....

This plugin does not work

By nissimboozaglo on January 29, 2020

This plugin does not work for me. In addition, after I installed it, I could not log back in to the WordPress backend. Had to disable the plugin through WP Engine to gain back the access. waste of time.

Works for me

By dazman88 on October 26, 2019

I spent 30 minutes looking for an alternative since reviews said it does not work. Should have saved my time as this plugin works perfectly, just install, activate and that's it.

Did not work

By plumwebsites on October 26, 2019

Didn't work and I was also unable to log back into wp-admin. I have to delete plugin to get back in.

Junk

By Duke Snoogens (MikeLoucas) on October 23, 2019

It put me in a Admin loop (logging in did nothing). I hade go into cPanel and remove the plug-in, and then all was well...

stop admin connexion after activation

By undigo on October 23, 2019

When I activate this plugin and I want to reconnect to admin panel, the login page keep the same login page and do not go to admin panel

1.5

  • Fixes a cookie expiration issue that was reported multiple times in the issue queue. Thanks to Jamie Magin (@jamagin at GitHub).

2.0

  • Requires PHP 7.0+
  • Requires WordPress 6.2+
  • Synced pluggable code from upstream for better compatibility with hooks.

2.1

  • Minor readme.txt updates
Back to top