Title: SameSite Cookies Author: Ayesh Karunaratne Published: 2. Mai 2019 Last modified: 23. Juli 2023 --- Plugins suchen ![](https://ps.w.org/samesite/assets/banner-772x250.jpg?rev=2155223) Dieses Plugin wurde **nicht mit den 3 neuesten Hauptversionen von WordPress getestet**. Es wird möglicherweise nicht mehr gepflegt oder unterstützt und kann bei der Verwendung mit neueren WordPress-Versionen zu Kompatibilitätsproblemen führen. ![](https://ps.w.org/samesite/assets/icon-256x256.jpg?rev=2155223) # SameSite Cookies Von [Ayesh Karunaratne](https://profiles.wordpress.org/ayeshrajans/) [Herunterladen](https://downloads.wordpress.org/plugin/samesite.2.1.zip) * [Details](https://de.wordpress.org/plugins/samesite/#description) * [Rezensionen](https://de.wordpress.org/plugins/samesite/#reviews) * [Installation](https://de.wordpress.org/plugins/samesite/#installation) * [Entwicklung](https://de.wordpress.org/plugins/samesite/#developers) [Support](https://wordpress.org/support/plugin/samesite/) ## Beschreibung This plugin adds the „SameSite“ cookie flag to WordPress’s authentication cookies. On supported browsers (all current IE, Edge, Chrome, and Firefox), this can effectively prevent all Cross-Site Request Forgery attacks throughout your WordPress site. SameSite cookie flag support was added to PHP on version 7.3, but this plugin ships with a workaround to **support all PHP versions** WordPress supports. There is no administrative UI provided: Activate this plugin, and you are all set! You can configure the SameSite flag value from your WordPress configuration file. You cna pick a value from `Lax` (default), `Strict`, or `None`. You can read about [SameSite cookies here](https://php.watch/articles/PHP-Samesite-cookies). To configure the `SameSite` flag value, edit your WordPress configuration file (` wp-config.php`), and add the following lines right above `/** Sets up WordPress vars and included files. */`. ``` define( 'WP_SAMESITE_COOKIE', 'Lax' ); // Pick from 'Lax', 'Strict', or 'None'. ``` Note that **only the authentication cookies are affected**. Regular cookies that your installed plugins set will **not** be affected, nor provide any meaningful value with `SameSite` flags. ## Screenshots * [[ * Browser response containing the SameSite attribute in Setcookie headers. ## Installation 1. Install this plugin as you would with any other plugin. 2. Aktiviere es. 3. There is no third step – From this point afterward, authentication cookies your WordPress site uses will contain SameSite flag, and you will be protected from CSRF attacks. If you find this plugin useful, I’d appreciate you leaving a review on the plugin page. ## FAQ ### The plugin doesn’t work !?!? Yeah, probably. This plugin uses what’s called „pluggable functions“ supported in WordPress to replace `wp_set_auth_cookie` function. This means that any other plugin that tampers with the login cookie parameters will override this plugin, and this plugin may not even get a chance to do what it does. ### How do I test if the plugin works Go to the Login page of your WordPress site, and open your browser’s development tools. Inspect the HTTP POST request made by the browser when you submit the login form. The response headers for `Setcookie` response headers must contain `Samesite =Lax` (or the configured value) if the plugin is working. Note that cookies apart from the authentication cookies are **not** handled by this plugin, nor it makes sense to add SameSite attribute to them. See the screenshot as well. ### Muss ich PHP 7.3 oder höher haben? No. [PHP 7.3 officially added SameSite cookie support](https://php.watch/versions/7.3/same-site-cookies), but this plugin comes with a polyfill to extend support to all previous PHP versions. ### Ist WordPress ohne dieses Plugin anfällig für CSRF-Angriffe? Ohne SameSite-Cookie müssen WordPress-Core- und Drittanbieter-Plugins ihre eigenen CSRF-Prüfungen implementieren, die übersehen werden können, [absichtlich ignoriert](https://de.wordpress.org/plugins/comment-form-csrf-protection/) werden oder manchmal nicht einmal darüber nachgedacht haben, was bei beigetragenen Plugins der Fall sein kann. Dieses Plugin versucht, dies mit unterschiedlichen Ansätzen zu lösen und bestehende Lösungen zu ergänzen. ## Rezensionen ![](https://secure.gravatar.com/avatar/3f08ba3325909ad31dca12032899b52d3ee5c4a7a7e92aca5c216ded95bceba0? s=60&d=retro&r=g) ### 󠀁[2024 This plugin DOES work.](https://wordpress.org/support/topic/2024-%e2%86%92-this-plugin-does-work/)󠁿 [Fer](https://profiles.wordpress.org/ferfactory/) 14. Mai 2024 Looks like nobody read the FAQ: The plugin doesn’t work !?!? Yeah, probably. This plugin uses what’s called “pluggable functions” supported in WordPress to replace wp_set_auth_cookie function.This means that any other plugin that tampers with the login cookie parameters will override this plugin, and this plugin may not even get a chance to do what it does. In my case, the issue was with the plugin WPS Hide Login. Disable that other plugin and this plugin worked correctly.EDIT: In case you still want to change the login URL, use the plugin Admin login URL Change. ![](https://secure.gravatar.com/avatar/16565b2baf17499a0d6bb1d111ae2480238987e5f414eea2bec5facedd13b4e9? s=60&d=retro&r=g) ### 󠀁[The plugin doesn’t work](https://wordpress.org/support/topic/the-plugin-doesnt-work-43/)󠁿 [tranhoang](https://profiles.wordpress.org/tranhoang/) 16. Juli 2021 I don’t know why the Author created this plugin, It does not work, please remove it from the plugin library ![](https://secure.gravatar.com/avatar/93af0c8ae062b5b3efc426e8585ebe23a4d762d8104f55fa9229be717720274c? s=60&d=retro&r=g) ### 󠀁[Wasted two days on this](https://wordpress.org/support/topic/wasted-two-days-on-this/)󠁿 [Rab Nawaz](https://profiles.wordpress.org/rnawaz02/) 15. September 2020 It does not work ![](https://secure.gravatar.com/avatar/bf350b03ea89f10db47db197e1408fd185647cbf5a9b9f5e6c4ea832196c1199? s=60&d=retro&r=g) ### 󠀁[it’s works](https://wordpress.org/support/topic/its-works-26/)󠁿 [ramazan12345](https://profiles.wordpress.org/ramazan12345/) 5. April 2020 Chrome was showing an error from the developer console. Errors disappeared when I installed this plugin. The plugin is working and problem-free. thank you ![](https://secure.gravatar.com/avatar/e77da3eb386c984ca5995a2e33dd3a98474f68c6dfb7c4d90a9fda10abc24be6? s=60&d=retro&r=g) ### 󠀁[It could work…](https://wordpress.org/support/topic/works-like-a-charm-1645/)󠁿 [pypmaker](https://profiles.wordpress.org/pypmaker/) 4. März 2020 It sorted out my problem. And created another – I can’t log into my site with this plugin installed! Unfortunately…. ![](https://secure.gravatar.com/avatar/7cbb07de535853152e3d55e4a218fd4deb60d726f0d39a66509a3fce6e7c2de8? s=60&d=retro&r=g) ### 󠀁[This plugin does not work](https://wordpress.org/support/topic/this-plugin-does-not-work-33/)󠁿 [nissimboozaglo](https://profiles.wordpress.org/nissimboozaglo/) 29. Januar 2020 This plugin does not work for me. In addition, after I installed it, I could not log back in to the WordPress backend. Had to disable the plugin through WP Engine to gain back the access. waste of time. [ Alle 11 Rezensionen lesen ](https://wordpress.org/support/plugin/samesite/reviews/) ## Mitwirkende und Entwickler „SameSite Cookies“ ist Open-Source-Software. Folgende Menschen haben an diesem Plugin mitgewirkt: Mitwirkende * [ Ayesh Karunaratne ](https://profiles.wordpress.org/ayeshrajans/) „SameSite Cookies“ wurde in 1 Sprache übersetzt. Danke an [die Übersetzer](https://translate.wordpress.org/projects/wp-plugins/samesite/contributors) für ihre Mitwirkung. [Übersetze „SameSite Cookies“ in deine Sprache.](https://translate.wordpress.org/projects/wp-plugins/samesite) ### Interessiert an der Entwicklung? [Durchstöbere den Code](https://plugins.trac.wordpress.org/browser/samesite/), sieh dir das [SVN-Repository](https://plugins.svn.wordpress.org/samesite/) an oder abonniere das [Entwicklungsprotokoll](https://plugins.trac.wordpress.org/log/samesite/) per [RSS](https://plugins.trac.wordpress.org/log/samesite/?limit=100&mode=stop_on_copy&format=rss). ## Änderungsprotokoll #### 1.5 * Fixes a cookie expiration issue that was reported multiple times in the issue queue. Thanks to Jamie Magin (@jamagin at GitHub). #### 2.0 * Requires PHP 7.0+ * Requires WordPress 6.2+ * Synced pluggable code from upstream for better compatibility with hooks. #### 2.1 * Minor readme.txt updates ## Meta * Version **2.1** * Zuletzt aktualisiert **vor 3 Jahren** * Aktive Installationen **800+** * WordPress-Version ** 6.2 oder höher ** * Getestet bis **6.3.8** * PHP-Version ** 7.0 oder höher ** * Sprachen * [English (US)](https://wordpress.org/plugins/samesite/) und [Norwegian (Bokmål)](https://nb.wordpress.org/plugins/samesite/). * [Übersetze in deine Sprache](https://translate.wordpress.org/projects/wp-plugins/samesite) * Schlagwörter * [cookies](https://de.wordpress.org/plugins/tags/cookies/)[csrf](https://de.wordpress.org/plugins/tags/csrf/) [samesite](https://de.wordpress.org/plugins/tags/samesite/)[security](https://de.wordpress.org/plugins/tags/security/) * [Erweiterte Ansicht](https://de.wordpress.org/plugins/samesite/advanced/) ## Bewertungen 2.5 von 5 Sternen. * [ 4 5-Sterne-Rezensionen ](https://wordpress.org/support/plugin/samesite/reviews/?filter=5) * [ 0 4-Sterne-Rezensionen ](https://wordpress.org/support/plugin/samesite/reviews/?filter=4) * [ 0 3-Sterne-Rezensionen ](https://wordpress.org/support/plugin/samesite/reviews/?filter=3) * [ 1 2-Sterne-Rezension ](https://wordpress.org/support/plugin/samesite/reviews/?filter=2) * [ 6 1-Sterne-Rezensionen ](https://wordpress.org/support/plugin/samesite/reviews/?filter=1) [Your review](https://wordpress.org/support/plugin/samesite/reviews/#new-post) [Alle Rezensionen anzeigen](https://wordpress.org/support/plugin/samesite/reviews/) ## Mitwirkende * [ Ayesh Karunaratne ](https://profiles.wordpress.org/ayeshrajans/) ## Support Behobene Probleme in den letzten zwei Monaten: 0 von 1 [Support-Forum anzeigen](https://wordpress.org/support/plugin/samesite/)