CSRF-protection for authentication cookies. When enabled, this plugin makes sure the "SameSite" flag is set in authentication cookies.
| Author: | Ayesh Karunaratne (profile at wordpress.org) |
| WordPress version required: | 6.2 |
| WordPress version tested: | 6.3 |
| Plugin version: | 2.1 |
| Added to WordPress repository: | 02-05-2019 |
| Last updated: | 23-07-2023 |
| Rating, %: | 46 |
| Rated by: | 10 |
| Plugin URI: | https://wordpress.org/plugins/samesite |
| Total downloads: | 17 563 |
| Active installs: | 1 000+ |
 Click to start download |
|
This plugin adds the “SameSite” cookie flag to WordPress’s authentication cookies. On supported browsers (all current IE, Edge, Chrome, and Firefox), this can effectively prevent all Cross-Site Request Forgery attacks throughout your WordPress site.
SameSite cookie flag support was added to PHP on version 7.3, but this plugin ships with a workaround to support all PHP versions WordPress supports.
There is no administrative UI provided: Activate this plugin, and you are all set!
You can configure the SameSite flag value from your WordPress configuration file. You cna pick a value from Lax (default), Strict, or None. You can read about SameSite cookies here.
To configure the SameSite flag value, edit your WordPress configuration file (wp-config.php), and add the following lines right above /** Sets up WordPress vars and included files. */.
define( 'WP_SAMESITE_COOKIE', 'Lax' ); // Pick from 'Lax', 'Strict', or 'None'.
Note that only the authentication cookies are affected. Regular cookies that your installed plugins set will not be affected, nor provide any meaningful value with SameSite flags.
Screenshots
FAQ
ChangeLog