3939; Development Value: 4096
4040; Production Value: 4096
4141
42- ; register_argc_argv
43- ; Default Value: On
44- ; Development Value: Off
45- ; Production Value: Off
46-
4742; request_order
4843; Default Value: None
4944; Development Value: "GP"
@@ -109,7 +104,6 @@ unserialize_callback_func =
109104serialize_precision = -1
110105; open_basedir =
111106disable_functions = pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
112- disable_classes =
113107; highlight.string = #DD0000
114108; highlight.comment = #FF9900
115109; highlight.keyword = #007700
@@ -154,7 +148,6 @@ log_errors = On
154148log_errors_max_len = 1024
155149ignore_repeated_errors = Off
156150ignore_repeated_source = Off
157- report_memleaks = On
158151; report_zend_debug = 0
159152xmlrpc_errors = 0
160153; xmlrpc_error_number = 0
@@ -178,7 +171,6 @@ html_errors = Off
178171; arg_separator.input = ";&"
179172variables_order = " GPCS"
180173request_order = " GP"
181- register_argc_argv = Off
182174auto_globals_jit = On
183175; enable_post_data_reading = Off
184176post_max_size = 128M
@@ -397,17 +389,17 @@ bcmath.scale = 0
397389[Session]
398390session.save_handler = files
399391session.save_path = " /var/cache/php-sessions"
400- session.use_strict_mode = 0
392+ session.use_strict_mode = 1
401393session.use_cookies = 1
402- ; session.cookie_secure =
394+ session.cookie_secure = 1
403395session.use_only_cookies = 1
404396session.name = PHPSESSID
405397session.auto_start = 0
406398session.cookie_lifetime = 0
407399session.cookie_path = /
408400session.cookie_domain =
409401session.cookie_httponly = 1
410- session.cookie_samesite =
402+ session.cookie_samesite = Lax
411403session.serialize_handler = php
412404session.gc_probability = 1
413405session.gc_divisor = 1000
@@ -416,10 +408,8 @@ session.referer_check =
416408session.cache_limiter = nocache
417409session.cache_expire = 180
418410session.use_trans_sid = 0
419- session.sid_length = 26
420411session.trans_sid_tags = " a=href,area=href,frame=src,form="
421412; session.trans_sid_hosts=""
422- session.sid_bits_per_character = 5
423413; session.upload_progress.enabled = On
424414; session.upload_progress.cleanup = On
425415; session.upload_progress.prefix = "upload_progress_"
@@ -545,3 +535,10 @@ opcache.validate_timestamps=1
545535[ffi]
546536; ffi.enable=preload
547537; ffi.preload=
538+
539+ ; References:
540+ ; WordPress does not use PHP native sessions. It uses authentication cookies and
541+ ; database-backed session tokens (WP_Session_Tokens). However, some plugins and
542+ ; admin tools (e.g., phpMyAdmin) may use PHP sessions, so these settings are
543+ ; configured securely as defense-in-depth.
544+ ; https://www.iflair.com/how-wordpress-handles-sessions-and-user-data-in-the-database/
0 commit comments