PHPackages phpwatch/wordpress-samesite - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Security](/categories/security) 4. / 5. phpwatch/wordpress-samesite ActiveWordpress-plugin[Security](/categories/security) phpwatch/wordpress-samesite =========================== This plugin adds the “SameSite” cookie flag to WordPress’s authentication cookies. On supported browsers (all current IE, Edge, Chrome, and Firefox), this can effectively prevent all Cross-Site Request Forgery attacks throughout your WordPress site. v2.1(2y ago)7145[2 issues](https://github.com/PHPWatch/WordPress-SameSite/issues)[1 PRs](https://github.com/PHPWatch/WordPress-SameSite/pulls)GPL-2.0-or-laterPHPPHP >=7.0.0 Since Jan 7Pushed 2y ago1 watchersCompare [ Source](https://github.com/PHPWatch/WordPress-SameSite)[ Packagist](https://packagist.org/packages/phpwatch/wordpress-samesite)[ Docs](https://wordpress.org/plugins/samesite/)[ RSS](/packages/phpwatch-wordpress-samesite/feed)WikiDiscussions master Synced 5d ago READMEChangelogDependencies (1)Versions (6)Used By (0) ``` === SameSite Cookies === Contributors: ayeshrajans Tags: security, csrf, cookies, samesite Requires at least: 6.2 Tested up to: 6.3 License: GPLv2 or later Stable tag: 2.1 Requires PHP: 7.0 CSRF-protection for authentication cookies. When enabled, this plugin makes sure the "SameSite" flag is set in authentication cookies. SameSite flag on a cookie prevents the browser from sending the cookie (thus, the authentication) on Cross-Site requests. This protects users from Cross-Site Request Forgery attacks. == Description == This plugin adds the "SameSite" cookie flag to WordPress's authentication cookies. On supported browsers (all current IE, Edge, Chrome, and Firefox), this can effectively prevent all Cross-Site Request Forgery attacks throughout your WordPress site. SameSite cookie flag support was added to PHP on version 7.3, but this plugin ships with a workaround to **support all PHP versions** WordPress supports. There is no administrative UI provided: Activate this plugin, and you are all set! You can configure the SameSite flag value from your WordPress configuration file. You cna pick a value from `Lax` (default), `Strict`, or `None`. You can read about [SameSite cookies here](https://php.watch/articles/PHP-Samesite-cookies). To configure the `SameSite` flag value, edit your WordPress configuration file (`wp-config.php`), and add the following lines right above `/** Sets up WordPress vars and included files. */`. `define( 'WP_SAMESITE_COOKIE', 'Lax' ); // Pick from 'Lax', 'Strict', or 'None'.` Note that **only the authentication cookies are affected**. Regular cookies that your installed plugins set will **not** be affected, nor provide any meaningful value with `SameSite` flags. == Installation == 1. Install this plugin as you would with any other plugin. 2. Enable it. 3. There is no third step - From this point afterward, authentication cookies your WordPress site uses will contain SameSite flag, and you will be protected from CSRF attacks. If you find this plugin useful, I'd appreciate you leaving a review on the plugin page. == Frequently Asked Questions == = The plugin doesn't work !?!? = Yeah, probably. This plugin uses what's called "pluggable functions" supported in WordPress to replace `wp_set_auth_cookie` function. This means that any other plugin that tampers with the login cookie parameters will override this plugin, and this plugin may not even get a chance to do what it does. = How do I test if the plugin works = Go to the Login page of your WordPress site, and open your browser's development tools. Inspect the HTTP POST request made by the browser when you submit the login form. The response headers for `Setcookie` response headers must contain `Samesite=Lax` (or the configured value) if the plugin is working. Note that cookies apart from the authentication cookies are **not** handled by this plugin, nor it makes sense to add SameSite attribute to them. See the screenshot as well. = Do I need to have PHP 7.3 or later? = No. [PHP 7.3 officially added SameSite cookie support](https://php.watch/versions/7.3/same-site-cookies), but this plugin comes with a polyfill to extend support to all previous PHP versions. = Is WordPress vulnerable to CSRF attacks without this plugin? = Without SameSite cookie, WordPress core and third party plugins must implement their own CSRF checks, which can be overlooked, [intentionally ignored](https://wordpress.org/plugins/comment-form-csrf-protection/), or sometimes not even have thought about, which can be the case for contributed plugin. This plugin attempts to solve this with different take and complement existing solutions. == Screenshots == 1. Browser response containing the SameSite attribute in Setcookie headers. == Changelog == = 1.5 = * Fixes a cookie expiration issue that was reported multiple times in the issue queue. Thanks to Jamie Magin (@jamagin at GitHub). = 2.0 = * Requires PHP 7.0+ * Requires WordPress 6.2+ * Synced pluggable code from upstream for better compatibility with hooks. = 2.1 = * Minor readme.txt updates ``` ### Health Score 26 — LowBetter than 43% of packages Maintenance14 Infrequent updates — may be unmaintained Popularity14 Limited adoption so far Community12 Small or concentrated contributor base Maturity56 Maturing project, gaining track record Bus Factor1 Top contributor holds 96% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~323 days Total 5 Last Release 1029d ago Major Versions v1.5 → v2.02023-07-23 PHP version history (2 changes)v1.2PHP >=5.6.0 v2.0PHP >=7.0.0 ### Community Maintainers ![](https://www.gravatar.com/avatar/1703f88c1f225e3fadff28458e81328f86668d9631a8c489f45ea1aaebe12df2?d=identicon)[Ayesh](/maintainers/Ayesh) --- Top Contributors [![Ayesh](https://avatars.githubusercontent.com/u/811553?v=4)](https://github.com/Ayesh "Ayesh (24 commits)")[![jamagin](https://avatars.githubusercontent.com/u/33543?v=4)](https://github.com/jamagin "jamagin (1 commits)") --- Tags wordpresswordpress-pluginwordpresssecuritycookieswordpress plugincsrfsamesitewordpress security ### Embed Badge ![Health badge](/badges/phpwatch-wordpress-samesite/health.svg) ``` [![Health](https://phpackages.com/badges/phpwatch-wordpress-samesite/health.svg)](https://phpackages.com/packages/phpwatch-wordpress-samesite) ``` ### Alternatives [owasp/csrf-protector-php CSRF protector php, a standalone php library for csrf mitigation in web applications. Easy to integrate in any php web app. 222348.3k4](/packages/owasp-csrf-protector-php)[brain/nonces OOP package for WordPress to deal with nonces. 26227.1k1](/packages/brain-nonces) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)