SameSite Cookies
CSRF-protection for authentication cookies. When enabled, this plugin makes sure the "SameSite" flag is set in authentication cookies.
The facts
- Rating
- 2.5★ from 11
- Active installs
- 700+
- Price
- Free
- Last updated
- 23 Jul 2023
- Added
- May 2019
- Requires WP
- 6.2
- Tested up to
- WP 6.3.10
- Requires PHP
- 7.0
- Downloads
- 24,670
Our analysis
AI-assistedSameSite Cookies is a WordPress plugin that adds the 'SameSite' cookie flag to authentication cookies, helping to prevent Cross-Site Request Forgery attacks on your site. It works by activating the plugin, and you can configure the SameSite flag value directly in your WordPress configuration file. The plugin is designed for users who want to enhance the security of their WordPress site without needing a complex setup.
This plugin is particularly suited for those who are familiar with editing configuration files and want to implement additional security measures without an administrative interface. It is aimed at users looking to protect their sites against specific types of web vulnerabilities.
Best for: This plugin suits WordPress site owners looking to improve security against CSRF attacks.
What it does well
- ✓Adds SameSite cookie flag to authentication cookies
- ✓Helps prevent Cross-Site Request Forgery attacks
- ✓Supports all current major browsers
- ✓Includes a workaround for older PHP versions
- ✓Simple activation with no UI needed
Where it falls short
- •Only affects authentication cookies, not regular cookies
- •No administrative interface provided
- •Limited user ratings and directory score
Verdict
SameSite Cookies offers a straightforward way to enhance authentication security. However, its limited scope and lack of user interface may not appeal to all users.
From the developer
Ayesh Karunaratne's own description of SameSite Cookies, lightly tidied.
This plugin adds the “SameSite” cookie flag to WordPress’s authentication cookies. On supported browsers (all current IE, Edge, Chrome, and Firefox), this can effectively prevent all Cross-Site Request Forgery attacks throughout your WordPress site.
SameSite cookie flag support was added to PHP on version 7.3, but this plugin ships with a workaround to support all PHP versions WordPress supports.
There is no administrative UI provided: Activate this plugin, and you are all set!
You can configure the SameSite flag value from your WordPress configuration file. You cna pick a value from Lax (default), Strict, or None. You can read about SameSite cookies here.
To configure the SameSite flag value, edit your WordPress configuration file (wp-config.php), and add the following lines right above /** Sets up WordPress vars and included files. */.
define( 'WP_SAMESITE_COOKIE', 'Lax' ); // Pick from 'Lax', 'Strict', or 'None'.
Note that only the authentication cookies are affected. Regular cookies that your installed plugins set will not be affected, nor provide any meaningful value with SameSite flags.