Skip to content

Instantly share code, notes, and snippets.

@martinvirtel
Last active January 27, 2017 14:46
Show Gist options
  • Save martinvirtel/a31119994c6af8d8dcc12ac427c13f8d to your computer and use it in GitHub Desktop.
Save martinvirtel/a31119994c6af8d8dcc12ac427c13f8d to your computer and use it in GitHub Desktop.
Wordpress + Apache: Extend lifetime of login cookies

Wordpress + Apache: Extend Cookie Lifetime

In standard Wordpress, your login will be saved for 48 hours, or 14 days if you click "remember me" on login. This configuration snippet allows you to extend that time to 30 days.

For this to work, your Wordpress has to live inside an Apache server, and the apache server has to have mod_headers activated. Then, include the file extend_wordpress_cookie_lifetime.conf into the configuration of your Apache server using the Include directive.

The snipped is configured to extend the valitiy to 30 days or 2592000 seconds. Feel free to change that value, but be aware of the year 2038 problem.

Dangers & Mitigation

Longer cookie lifetime means your cookie is more valuable if it's stolen. Always use SSL, it's dead simple with Apache thanks to letsencrypt.

If a cookie gets stolen, you can logout yourself out of "other sessions" using a button in your Wordpress profile, here is an explanation. Programmatically, do it following this stackexchange answer.

Bugs

The snippet currently does not strip the "old" Max-Age value from the cookie, though it could easily extended to do so. So the cookie might end up with two Max-Age settings. It depends on the browser how two conflicting Max-Age values are handled.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment