为什么我的 Wordpress 网站设置了 PHPSESSID cookie？

Question

I am currently struggling with the GDPR and all the changes it requires me to apply to my websites. One of my Wordpress websites, which uses a theme I made myself, sets a cookie named PHPSESSID which stores the session ID - not triggered by any particular action, just when any page of the website is opened.

The strange thing about it is:

1.) I definitely have nothing in my theme code that would do this.

2.) I have two identical versions of this website, one for testing on my own webspace and domain, the other on the clients domain and webspace. The provider is the same in both cases, so I suppose it's the same server configuration. The PHP version is the same (7.2). I have the same theme and plugins in both versions, still the performance site DOES set that cookie, the test site DOES NOT.

Now, all I actually want is to get rid of that cookie. I am not using any other cookies on that site and I don't want to have to put a cookie notice on that site.

Would anyone have an idea where that cookie could come from and how I could get the server/website to NOT set it?

Answer 1

This is for session. If you are using session by using session_start() at the most top of your script. You can find this name (PHPSESSIONID) as an option value in your php.ini following part is from mine (php on IIS)

; Name of the session (used as cookie name).
; http://php.net/session.name
session.name = PHPSESSID

I suspect that (without having trying) that you have a cookie because there is an other option set

; Whether to use cookies.
; http://php.net/session.use-cookies
session.use_cookies = 1

you can read more about session and session cookies here http://php.net/manual/en/session.configuration.php#ini.session.use-cookies

Answer 2

To whoever is interested: I found out that it was due to a plugin. I had two slightly different versions/updates of that one plugin, one setting the PHPSESSID cookie (obviously before any php page is loaded), the other one not.

Sorry, I should have checked that before (I found out by deactivating all plugins one by one). But my problem is solved now - thanks to everybody who replied!

Answer 3

For folks who might come across this, for me I'm pretty sure it was also a plugin: https://wordpress.org/plugins/wp-super-cache/

But I don't think it was actually the plugin's fault, per se. Disabling it, then re-enabling it, THEN making sure it's settings enabled caching, seemed to "clear" the HTTP-only cookies. Basically I think the plugin was set up to work, but wasn't being used, so old HTTP-only images were being cached - even though I was consistently linking to HTTPS images. Anyway, just in case it might help.