auth_cookie_expiration() only works if you check “remember me”.

Ask:

I was asked if I could adjust a WordPress website so that logged in users would stay logged in for 1 day.

This regardless of whether they close the browser or restart their device. For security, they have to log in again after a day.

For this I added the following PHP code to functions.php:

function custom_login_session($expiration) {
    $expiration = 86400 // in seconds;

    return $expiration;
}
add_filter('auth_cookie_expiration', 'custom_login_session', 99, 1);

Explanation:

WordPress uses a cookie to determine how long you can stay logged in. If you delete cookies yourself, via a program or if you close the browser, the function “stay logged in” will not work. You must log in immediately next time.

With the PHP code above you can extend the duration of a session to a maximum of 1 day. Session means the time that you automatically remain logged in to the website.

It does not work:

The only problem is that the above PHP code is not executed. As a result, you are immediately logged out if you end your session by, for example, closing the browser.

Answer:

The answer is very simple.

WordPress performs “auth_cookie_expiration()” only off if you check “Remember me” on the login form. This is also known as the “remberme” function in WordPress. You can also see this very clearly if you read the code of “wp_set_auth_cookie()” viewing.

If you check the box you will stay logged in for 1 day in combination with the above PHP function. You can check this by requesting the cookies in the browser’s developer toolbar. To do this, check the age of the “wordpress_logged_in_*” cookie.

On the internet you can find JS scripts that check the box by default. Unfortunately, there is no PHP option for it that will enable the Remember Me feature by default.

> Also read how you can log in to WordPress via a unique one-time link

Related Blogs