SameSite Cookies
This plugin adds the “SameSite” cookie flag to WordPress’s authentication cookies. On supported browsers (all current IE, Edge, Chrome, and Firefox), this can effectively prevent all Cross-Site Request Forgery attacks throughout your WordPress site. SameSite cookie flag support was added to PHP on v
About this tool.
This plugin adds the “SameSite” cookie flag to WordPress’s authentication cookies. On supported browsers (all current IE, Edge, Chrome, and Firefox), this can effectively prevent all Cross-Site Request Forgery attacks throughout your WordPress site.
SameSite cookie flag support was added to PHP on version 7.3, but this plugin ships with a workaround to support all PHP versions WordPress supports.
There is no administrative UI provided: Activate this plugin, and you are all set!
You can configure the SameSite flag value from your WordPress configuration file. You cna pick a value from Lax (default), Strict , or None . You can read about SameSite cookies here .
To configure the SameSite flag value, edit your WordPress configuration file ( wp-config.php ), and add the following lines right above /** Sets up WordPress vars and included files. */ .
define( 'WP_SAMESITE_COOKIE', 'Lax' ); // Pick from 'Lax', 'Strict', or 'None'.
Note that only the authentication cookies are affected . Regular cookies that your installed plugins set will not be affected, nor provide any meaningful value with SameSite flags.
A closer look.
Getting started.
- 01Install this plugin as you would with any other plugin.
- 02Enable it.
- 03There is no third step – From this point afterward, authentication cookies your WordPress site uses will contain SameSite flag, and you will be protected from CSRF attacks.
If you find this plugin useful, I’d appreciate you leaving a review on the plugin page.
Frequently asked questions.
The plugin doesn’t work !?!?
Yeah, probably. This plugin uses what’s called “pluggable functions” supported in WordPress to replace wp_set_auth_cookie function. This means that any other plugin that tampers with the login cookie parameters will override this plugin, and this plugin may not even get a chance to do what it does.
How do I test if the plugin works
Go to the Login page of your WordPress site, and open your browser’s development tools. Inspect the HTTP POST request made by the browser when you submit the login form. The response headers for Setcookie response headers must contain Samesite=Lax (or the configured value) if the plugin is working.
