Title: SameSite Cookies
Author: Ayesh Karunaratne
Published: <strong>మే 2, 2019</strong>
Last modified: జూలై 23, 2023

---

Search plugins

![](https://ps.w.org/samesite/assets/banner-772x250.jpg?rev=2155223)

This plugin **hasn’t been tested with the latest 3 major releases of WordPress**.
It may no longer be maintained or supported and may have compatibility issues when
used with more recent versions of WordPress.

![](https://ps.w.org/samesite/assets/icon-256x256.jpg?rev=2155223)

# SameSite Cookies

 By [Ayesh Karunaratne](https://profiles.wordpress.org/ayeshrajans/)

[Download](https://downloads.wordpress.org/plugin/samesite.2.1.zip)

 * [Details](https://te.wordpress.org/plugins/samesite/#description)
 * [Reviews](https://te.wordpress.org/plugins/samesite/#reviews)
 *  [Installation](https://te.wordpress.org/plugins/samesite/#installation)
 * [Development](https://te.wordpress.org/plugins/samesite/#developers)

 [Support](https://wordpress.org/support/plugin/samesite/)

## Description

This plugin adds the “SameSite” cookie flag to WordPress’s authentication cookies.
On supported browsers (all current IE, Edge, Chrome, and Firefox), this can effectively
prevent all Cross-Site Request Forgery attacks throughout your WordPress site.

SameSite cookie flag support was added to PHP on version 7.3, but this plugin ships
with a workaround to **support all PHP versions** WordPress supports.

There is no administrative UI provided: Activate this plugin, and you are all set!

You can configure the SameSite flag value from your WordPress configuration file.
You cna pick a value from `Lax` (default), `Strict`, or `None`. You can read about
[SameSite cookies here](https://php.watch/articles/PHP-Samesite-cookies).

To configure the `SameSite` flag value, edit your WordPress configuration file (`
wp-config.php`), and add the following lines right above `/** Sets up WordPress 
vars and included files. */`.

    ```
    define( 'WP_SAMESITE_COOKIE', 'Lax' ); // Pick from 'Lax', 'Strict', or 'None'.
    ```

Note that **only the authentication cookies are affected**. Regular cookies that
your installed plugins set will **not** be affected, nor provide any meaningful 
value with `SameSite` flags.

## Screenshots

 * [[
 * Browser response containing the SameSite attribute in Setcookie headers.

## Installation

 1. Install this plugin as you would with any other plugin.
 2. Enable it.
 3. There is no third step – From this point afterward, authentication cookies your
    WordPress site uses will contain SameSite flag, and you will be protected from 
    CSRF attacks.

If you find this plugin useful, I’d appreciate you leaving a review on the plugin
page.

## FAQ

### The plugin doesn’t work !?!?

Yeah, probably. This plugin uses what’s called “pluggable functions” supported in
WordPress to replace `wp_set_auth_cookie` function.
 This means that any other plugin
that tampers with the login cookie parameters will override this plugin, and this
plugin may not even get a chance to do what it does.

### How do I test if the plugin works

Go to the Login page of your WordPress site, and open your browser’s development
tools. Inspect the HTTP POST request made by the browser when you submit the login
form. The response headers for `Setcookie` response headers must contain `Samesite
=Lax` (or the configured value) if the plugin is working.

Note that cookies apart from the authentication cookies are **not** handled by this
plugin, nor it makes sense to add SameSite attribute to them.

See the screenshot as well.

### Do I need to have PHP 7.3 or later?

No. [PHP 7.3 officially added SameSite cookie support](https://php.watch/versions/7.3/same-site-cookies),
but this plugin comes with a polyfill to extend support to all previous PHP versions.

### Is WordPress vulnerable to CSRF attacks without this plugin?

Without SameSite cookie, WordPress core and third party plugins must implement their
own CSRF checks, which can be overlooked, [intentionally ignored](https://wordpress.org/plugins/comment-form-csrf-protection/),
or sometimes not even have thought about, which can be the case for contributed 
plugin. This plugin attempts to solve this with different take and complement existing
solutions.

## Reviews

![](https://secure.gravatar.com/avatar/3f08ba3325909ad31dca12032899b52d3ee5c4a7a7e92aca5c216ded95bceba0?
s=60&d=retro&r=g)

### 󠀁[2024  This plugin DOES work.](https://wordpress.org/support/topic/2024-%e2%86%92-this-plugin-does-work/)󠁿

 [Fer](https://profiles.wordpress.org/ferfactory/) మే 14, 2024

Looks like nobody read the FAQ: The plugin doesn’t work !?!? Yeah, probably. This
plugin uses what’s called “pluggable functions” supported in WordPress to replace
wp_set_auth_cookie function.This means that any other plugin that tampers with the
login cookie parameters will override this plugin, and this plugin may not even 
get a chance to do what it does. In my case, the issue was with the plugin WPS Hide
Login. Disable that other plugin and this plugin worked correctly.EDIT: In case 
you still want to change the login URL, use the plugin Admin login URL Change.

![](https://secure.gravatar.com/avatar/16565b2baf17499a0d6bb1d111ae2480238987e5f414eea2bec5facedd13b4e9?
s=60&d=retro&r=g)

### 󠀁[The plugin doesn’t work](https://wordpress.org/support/topic/the-plugin-doesnt-work-43/)󠁿

 [tranhoang](https://profiles.wordpress.org/tranhoang/) జూలై 16, 2021

I don’t know why the Author created this plugin, It does not work, please remove
it from the plugin library

![](https://secure.gravatar.com/avatar/93af0c8ae062b5b3efc426e8585ebe23a4d762d8104f55fa9229be717720274c?
s=60&d=retro&r=g)

### 󠀁[Wasted two days on this](https://wordpress.org/support/topic/wasted-two-days-on-this/)󠁿

 [Rab Nawaz](https://profiles.wordpress.org/rnawaz02/) సెప్టెంబర్ 15, 2020

It does not work

![](https://secure.gravatar.com/avatar/bf350b03ea89f10db47db197e1408fd185647cbf5a9b9f5e6c4ea832196c1199?
s=60&d=retro&r=g)

### 󠀁[it’s works](https://wordpress.org/support/topic/its-works-26/)󠁿

 [ramazan12345](https://profiles.wordpress.org/ramazan12345/) ఏప్రిల్ 5, 2020

Chrome was showing an error from the developer console. Errors disappeared when 
I installed this plugin. The plugin is working and problem-free. thank you

![](https://secure.gravatar.com/avatar/e77da3eb386c984ca5995a2e33dd3a98474f68c6dfb7c4d90a9fda10abc24be6?
s=60&d=retro&r=g)

### 󠀁[It could work…](https://wordpress.org/support/topic/works-like-a-charm-1645/)󠁿

 [pypmaker](https://profiles.wordpress.org/pypmaker/) మార్చి 4, 2020

It sorted out my problem. And created another – I can’t log into my site with this
plugin installed! Unfortunately….

![](https://secure.gravatar.com/avatar/7cbb07de535853152e3d55e4a218fd4deb60d726f0d39a66509a3fce6e7c2de8?
s=60&d=retro&r=g)

### 󠀁[This plugin does not work](https://wordpress.org/support/topic/this-plugin-does-not-work-33/)󠁿

 [nissimboozaglo](https://profiles.wordpress.org/nissimboozaglo/) జనవరి 29, 2020

This plugin does not work for me. In addition, after I installed it, I could not
log back in to the WordPress backend. Had to disable the plugin through WP Engine
to gain back the access. waste of time.

 [ Read all 11 reviews ](https://wordpress.org/support/plugin/samesite/reviews/)

## Contributors & Developers

“SameSite Cookies” is open source software. The following people have contributed
to this plugin.

Contributors

 *   [ Ayesh Karunaratne ](https://profiles.wordpress.org/ayeshrajans/)

“SameSite Cookies” has been translated into 1 locale. Thank you to [the translators](https://translate.wordpress.org/projects/wp-plugins/samesite/contributors)
for their contributions.

[Translate “SameSite Cookies” into your language.](https://translate.wordpress.org/projects/wp-plugins/samesite)

### Interested in development?

[Browse the code](https://plugins.trac.wordpress.org/browser/samesite/), check out
the [SVN repository](https://plugins.svn.wordpress.org/samesite/), or subscribe 
to the [development log](https://plugins.trac.wordpress.org/log/samesite/) by [RSS](https://plugins.trac.wordpress.org/log/samesite/?limit=100&mode=stop_on_copy&format=rss).

## Changelog

#### 1.5

 * Fixes a cookie expiration issue that was reported multiple times in the issue
   queue. Thanks to Jamie Magin (@jamagin at GitHub).

#### 2.0

 * Requires PHP 7.0+
 * Requires WordPress 6.2+
 * Synced pluggable code from upstream for better compatibility with hooks.

#### 2.1

 * Minor readme.txt updates

## Meta

 *  Version **2.1**
 *  Last updated **3 సంవత్సరాలు ago**
 *  Active installations **900+**
 *  WordPress version ** 6.2 or higher **
 *  Tested up to **6.3.8**
 *  PHP version ** 7.0 or higher **
 *  Languages
 * [English (US)](https://wordpress.org/plugins/samesite/) మరియు [Norwegian (Bokmål)](https://nb.wordpress.org/plugins/samesite/).
 *  [Translate into your language](https://translate.wordpress.org/projects/wp-plugins/samesite)
 * Tags
 * [cookies](https://te.wordpress.org/plugins/tags/cookies/)[csrf](https://te.wordpress.org/plugins/tags/csrf/)
   [samesite](https://te.wordpress.org/plugins/tags/samesite/)[security](https://te.wordpress.org/plugins/tags/security/)
 *  [Advanced View](https://te.wordpress.org/plugins/samesite/advanced/)

## Ratings

 2.5 out of 5 stars.

 *  [  4 5-star reviews     ](https://wordpress.org/support/plugin/samesite/reviews/?filter=5)
 *  [  0 4-star reviews     ](https://wordpress.org/support/plugin/samesite/reviews/?filter=4)
 *  [  0 3-star reviews     ](https://wordpress.org/support/plugin/samesite/reviews/?filter=3)
 *  [  1 2-star review     ](https://wordpress.org/support/plugin/samesite/reviews/?filter=2)
 *  [  6 1-star reviews     ](https://wordpress.org/support/plugin/samesite/reviews/?filter=1)

[Add my review](https://wordpress.org/support/plugin/samesite/reviews/#new-post)

[See all reviews](https://wordpress.org/support/plugin/samesite/reviews/)

## Contributors

 *   [ Ayesh Karunaratne ](https://profiles.wordpress.org/ayeshrajans/)

## Support

Got something to say? Need help?

 [View support forum](https://wordpress.org/support/plugin/samesite/)