Title: PHP sessions
Author: WordPress VIP Documentation
Published: September 12, 2024
Last modified: March 18, 2025

---

 1. [WordPress on VIP](https://docs.wpvip.com/wordpress-on-vip/)
 2. [PHP](https://docs.wpvip.com/wordpress-on-vip/php/)
 3. PHP sessions

#  PHP sessions

WordPress VIP supports [PHP sessions](https://www.php.net/manual/en/book.session.php)
for storing short-lived, ephemeral session data. Session data is backed by Memcached
to improve performance, but to ensure a site’s stability and scalability the performance
of its underlying code should be optimized wherever possible.

Sessions can be useful in certain scenarios but they also have performance implications
that should be carefully considered.

## Considerations

When PHP sessions are used:

 * All requests made by a user with a session will [bypass the page cache](https://docs.wpvip.com/caching/page-cache/).
   An increase in requests that bypass the page cache can have negative impacts 
   on site performance. Indications of negative effects on performance can be observed
   in [the “Page Cache Hit Rate” section](https://docs.wpvip.com/performance/insights-metrics/cache-metrics/#Page-Cache-Hit-Rate)
   of **Insights & Metrics** in the VIP Dashboard.
 * Consider limiting the scope of a session by starting a session only at the moment
   the need for it begins, then destroying the session as soon as the need for it
   ends.
 * Sessions can also be started for specific URLs by setting the `path` parameter
   of `session_set_cookie_params()`. This can help to limit the number of uncacheable
   URLs.

## Runtime configurations

By default, the VIP Platform uses the [default runtime configurations for session cookies as outlined in the PHP Manual](https://www.php.net/manual/en/session.configuration.php)
except for setting `httponly` and `secure` as true. This ensures that session cookies
will only be sent with `HTTPS` requests (the default on all WordPress VIP sites)
and prevents session cookies from being accessible to JavaScript.

These default settings can be overridden using `ini_set()` or `[session_set_cookie_params()](https://www.php.net/manual/en/function.session-set-cookie-params.php)`
in `[vip-config/vip-config.php](https://docs.wpvip.com/wordpress-skeleton/vip-config-directory/)`.
However, changing the settings for `httponly` and `secure` is strongly discouraged
as this would weaken the security of your application.

### Session Timeout

One commonly changed runtime session configuration is changing the session timeout
duration using [`session.gc_maxlifetime`](https://www.php.net/manual/en/session.configuration.php#ini.session.gc-maxlifetime)
to change the amount of time that users are logged into WordPress. By default, this
is configured to be `"1440"` but is able to be changed.

Last updated: March 18, 2025