Daniel Bachhuber

Chris Reynolds

Pantheon Systems

John Spellman

Andrew Taylor

mpvanwinkle77

Josh Koenig

rwagner00

stovak

<a href="https://travis-ci.org/pantheon-systems/wp-native-php-sessions" rel="nofollow ugc"></a> <a href="https://circleci.com/gh/pantheon-systems/wp-native-php-sessions/tree/master" rel="nofollow ugc"></a>
WordPress core does not use PHP sessions, but sometimes they are required by your use-case, a plugin or theme.
This plugin implements PHP’s native session handlers, backed by the WordPress database. This allows plugins, themes, and custom code to safely use PHP <code>$_SESSION</code>s in a distributed environment where PHP’s default tempfile storage just won’t work.
Note that primary development is on GitHub if you would like to contribute:
https://github.com/pantheon-systems/wp-native-php-sessions
<h3>Configuration</h3>
By default the session lifetime is set to 0, which is until the browser is closed.
To override this use the <code>pantheon_session_expiration</code> filter before the Native PHP Sessions plugin is loaded. For example a small Must-use plugin (a.k.a. mu-plugin) could contain:
<pre><code><?php
function my_session_expiration_override() {
 return 60*60*4; // 4 hours
}
add_filter( 'pantheon_session_expiration', 'my_session_expiration_override' );<h3>CLI Commands</h3>
</code></pre>
wp pantheon session add-index
Added in 1.4.0. This command should be run if your installation of the plugin occurred before the addition of the primary ID key to the session table in version 1.2.2. You will be automatically notified when you visit any admin page if this is the case. If there’s no message, your version is good to go. Note that this command is non-destructive, a new table will be created and the existing one preserved in a backup state until you have verified that the upgrade is functioning as expected.
wp pantheon session primary-key-finalize
Added in 1.4.0. If you have run the <code>add-index</code> command and have verified that the new table is functioning correctly, running the <code>primary-key-finalize</code> command will perform a database cleanup and remove the backup table.
wp pantheon session primary-key-revert
Added in 1.4.0. If you have run the <code>add-index</code> command and something unexpected has occurred, just run the <code>primary-key-revert</code> command and the backup table will immediately be returned to being the active table.
<h4>WordPress Multisite</h4>
As of 1.4.2 the <code>add-index</code>, <code>primary-key-add</code> and <code>primary-key-revert</code> commands are fully multisite compatible.
<h3>Contributing</h3>
See <a href="https://github.com/pantheon-systems/wp-native-php-sessions/blob/main/CONTRIBUTING.md" rel="nofollow ugc">CONTRIBUTING.md</a> for information on contributing.
<h3>Troubleshooting</h3>
If you see an error like “Fatal error: session_start(): Failed to initialize storage module:” or “Warning: ini_set(): A session is active.”, then you likely have a plugin that is starting a session before WP Native PHP Sessions is loading.
To fix, create a new file at <code>wp-content/mu-plugins/000-loader.php</code> and include the following:
<pre><code><?php
if (file_exists(WP_PLUGIN_DIR . '/wp-native-php-sessions/pantheon-sessions.php')) {
 require_once WP_PLUGIN_DIR . '/wp-native-php-sessions/pantheon-sessions.php';
}
</code></pre>
This mu-plugin will load WP Native PHP Sessions before all other plugins, while letting you still use the WordPress plugin updater to keep the plugin up-to-date.

Native PHP Sessions

I did not have high hopes for this, looking for plugins to resolve the issue my site was having in Site Health and figured I might as well try  this after running across it on Google. I installed it, and it fixed loopback requests and API issues in Site Health. I am very impressed! 

Wow! This plugin works great!

Use native PHP sessions and stay horizontally scalable. Better living through superior technology.

Rynald0s

Session Shredder is a production-grade, rule-based session cleanup plugin for WooCommerce 10.3+.
WooCommerce 10.3 introduces experimental guest session storage and auto-pruning. Session Shredder builds directly on this already available foundation and adds behavior-based heuristics that predict which sessions are zombies (safe to prune) versus keepers (should be retained).
Highlights
– Heuristic pruning – Uses anonymized features (session age, pageviews, cart value, etc.) and conservative rules to identify low-value sessions. 
– Configurable rules & thresholds – Tune base age, hard timeout, bounce detection, and cart-protection rules from a dedicated WooCommerce settings screen. 
– Safe thresholds – Only considers sessions past a base age window and is biased towards keeping anything that shows meaningful activity or cart value. 
– Robust behavior – Even if tracking data is sparse, a conservative rule-based strategy kicks in (e.g. hard 72h timeout, bounces with no cart value). 
– Privacy-first – No PII is stored. Session IDs and countries are hashed; only coarse behavioral data is used. 
– Native Woo 10.3 integration – Reads from the WooCommerce session table (supports both legacy and new tables) and plays nicely with the core experimental pruning. 
– HPOS compatible – Declares compatibility with WooCommerce High-Performance Order Storage (custom order tables) and never touches orders, only session data. 
– Admin dashboard – Under WooCommerce → Session Shredder you get active sessions, pruned counts, a Chart.js visualization of active & pruned sessions per run, and a compact “Recent runs” summary. 
– Logging & observability – Uses <code>wc_get_logger()</code> for info/error logging; integrates cleanly with existing WooCommerce logs.
Session Shredder is structured for real-world stores and designed as a companion to WooCommerce’s experimental guest session engine. It stays fully rule-based out of the box, but developers can extend it via hooks if they ever want to plug in external scoring services or AI endpoints.
Why not rely only on the WooCommerce experimental pruning?
– Core experimental pruning is largely age-based and opaque. 
– Session Shredder adds behavior-aware rules (pageviews, cart value, bounce flag) on top of age. 
– You get a dry-run mode to analyze impact before deleting anything. 
– The dashboard gives you visibility into how many sessions were pruned per run and how many sessions remained active. 
– WP-CLI commands let you script and automate analyze/prune runs. 
– It works alongside WooCommerce experimental guest sessions and HPOS rather than replacing them: Woo can still prune based on its own rules, while Session Shredder adds a tunable, rule-based layer with better reporting.
<h3>How It Works</h3>
<ol>
<li>
Feature collection 
– On each page load, Session Shredder tracks session activity: 
 – Session age (hours since first seen) 
 – Pageviews count 
 – Cart value (numeric) 
 – Whether anything was added to cart 
 – Geolocation hash (hashed billing/shipping country) 
 – Simple bounce indicator (single pageview, no cart) 
– Features are stored per-session in non-autoloaded options and never include raw session IDs or user identifiers.
</li>
<li>
Rule-based pruning 
– An hourly cron (<code>session_shredder_cron</code>) scans the WooCommerce session table for candidates based on age. 
– For each candidate, the plugin: 
 – Loads stored features 
 – Applies conservative rules like: 
 – Session older than a hard timeout window (e.g. 72 hours) 
 – Single pageview and no cart value 
– If the rules deem the session a low-value “zombie”, it is pruned.
</li>
<li>
Stats & visualization
– After each real run, Session Shredder records: 
 – Total pruned sessions (lifetime and today) 
 – A short history of recent runs, including how many sessions were pruned and how many remained active before/after each run 
– The admin dashboard renders a Chart.js line graph of active & pruned sessions per run via a secure AJAX endpoint, plus a compact “Recent runs” table.
</li>
</ol>
<h3>For developers</h3>
Session Shredder exposes a small set of hooks and CLI commands so you can integrate it into more advanced workflows without forking the plugin.
<h4>Hooks</h4>
– <code>session_shredder_features( array $features, string $session_hash )</code> 
 – Filter the behavior feature array before it is stored and later used for pruning decisions. 
 – <code>$session_hash</code> is a hashed identifier of the session (no raw IDs or PII).
– <code>session_shredder_base_age_hours( float $base_age_hours )</code> 
 – Adjust the base age window (in hours) before sessions are considered as prune candidates.
– <code>session_shredder_should_prune( bool $should_prune, array $features )</code> 
 – Override or refine the core rule-based decision for a given session.
– <code>session_shredder_feature_options_soft_limit( int $soft_limit )</code> 
 – Adjust the soft cap for how many per-session feature options (<code>session_shredder_features_*</code>) are kept in <code>wp_options</code> before garbage collection trims the oldest entries.
– <code>session_shredder_feature_options_gc_batch( int $batch_size )</code> 
 – Adjust how many feature options are removed per garbage-collection pass when the soft limit is exceeded. Larger values clean up faster; smaller values spread work over more runs.
– <code>session_shredder_before_run( float $base_age_hours, bool $dry_run )</code> 
 – Fires before a prune run (cron, manual, or CLI) starts.
– <code>session_shredder_after_run( int $pruned_count, bool $dry_run )</code> 
 – Fires after a prune run completes (dry-run or real).
– <code>session_shredder_pruned( int $pruned_count )</code> 
 – Fires after a real prune run that actually deletes sessions; useful for logging or additional cleanup.
<h4>WP-CLI commands</h4>
If WP-CLI is available, Session Shredder registers the following commands:
– <code>wp session-shredder analyze</code> 
 – Performs a dry run using the current rules and settings. 
 – Outputs the total number of sessions and how many would be pruned, without deleting anything.
– <code>wp session-shredder prune</code> 
 – Runs a real prune using the current rules and settings. 
 – Deletes matching sessions, updates stats, and logs a summary.

Session Shredder for WooCommerce

Smart rule-based pruning for WooCommerce 10.3+. Enhances experimental session storage with behavior signals to remove zombie sessions and cut DB size.

Native PHP Sessions vs Session Shredder for WooCommerce