This plugin adds the “SameSite” cookie flag to WordPress’s authentication cookies. On supported browsers (all current IE, Edge, Chrome, and Firefox), this can effectively prevent all Cross-Site Request Forgery attacks throughout your WordPress site.
SameSite cookie flag support was added to PHP on version 7.3, but this plugin ships with a workaround to support all PHP versions WordPress supports.
There is no administrative UI provided: Activate this plugin and you are all set!
You can configure the SameSite flag value from your WordPress configuration file. You cna pick a value from
None. You can read about SameSite cookies here.
To configure the
SameSite flag value, edit your WordPress configuration file (
wp-config.php), and add the following lines right above
/** Sets up WordPress vars and included files. */.
define( ‘WP_SAMESITE_COOKIE’, ‘Lax’ ); // Pick from ‘Lax’, ‘Strict’, or ‘None’.
Note that only the authentication cookies are affected. Regular cookies that your installed plugins set will not be affected, nor provide any meaningful value with
- Install this plugin as you would with any other plugin.
- Enable it.
- There is no third step – From this point afterwards, authentication cookies your WordPress site uses will contain SameSite flag, and you will be protected from CSRF attacks.
If you find this plugin useful, I’d appreciate you leaving a review on the plugin page.
Do I need to have PHP 7.3 or later?
No. PHP 7.3 officially added SameSite cookie support, but this plugin comes with a polyfill to extend support to all previous PHP versions.
Is WordPress vulnerable to CSRF attacks without this plugin?
Without SameSite cookie, WordPress core and third party plugins must implement their own CSRF checks, which can be overlooked, intentionally ignored, or sometimes not even have thought about, which can be the case for contributed plugin. This plugin attempts to solve this with different take and complement existing solutions.
“SameSite Cookies” 是开源软件。 以下人员对此插件做出了贡献。贡献者
- Fixes a cookie expiration issue that was reported multiple times in the issue queue. Thanks to Jamie Magin (@jamagin at GitHub).