You can use the auth_cookie_expiration
filter to change the expiration time of the cookie WordPress sets to remember you. The user won’t be logged out unless they change browser or clear their cookies (normally part of clearing history).
The problem is that you can’t set a cookie to never expire, so you have to set a date in the far future. The furthest you can go is 19th January 2038, because of the Year 2038 problem.
The value of the auth_cookie_expiration
filter is added to time()
so if you want to set the longest possible time for the cookie, you need to get the maximum value (2147483647
according to this) and subtract time()
:
function wpse_287104_cookie_expiration( $length ) {
return time() - 2147483647;
}
add_filter( 'auth_cookie_expiration', 'wpse_287104_cookie_expiration' );
Related Posts:
- What’s the best approach for generating a new API key?
- Simplest two-way encryption using PHP
- How does the SQL injection from the “Bobby Tables” XKCD comic work?
- how fix “this certificate cannot be verified up to a trusted certification authority”
- How can bcrypt have built-in salts?
- Getting a List of Currently Available Roles on a WordPress Site?
- What’s the easiest way to stop WP from ever logging me out
- Prevent access or auto-delete readme.html, license.txt, wp-config-sample.php
- How safe / sanitized is wp_insert_posts()?
- From a security standpoint, should bloginfo() or get_bloginfo() be escaped?
- Why are passwords exportable as plain text in WordPress?
- What’s the difference between esc_* functions?
- How to set up fail2ban with WordFence?
- Is there a way to force ssl on certain pages
- What is the purpose of having a token in cookies?
- How to remove “Connection Information” requirement on localhost install of WP on MACOSX
- How is password strength calculated?
- Regular security checks – what steps should be included?
- What are the pros and cons of using a custom front-end to retrieve content from a WordPress back-end
- WordPress “Site Health Status” trust it or myself for its security advice?
- Do Cookies Need to be Sanatized Before Being Saved?
- Disable external access to REST API Endpoint
- What is the wp-includes/certificates/ca-bundle.crt used for?
- Do you need to escape hard coded plain text?
- Encrypt emails?
- WordPress salts set in config and database
- Can I force a password change?
- What is the relationship between cURL, WordPress and cacert.pem?
- Is it necessary to use esc_url with template tags such as get_permalink?
- What is pclzip.lib.php file that wordfence think it’s a malicious code
- How to prevent bot or someone to modify any file automatically?
- How to disable XML-RPC from Linux command-line in a total way?
- HTTP Security Headers in wp-config
- How to remove javascript malware in wordpress site [closed]
- Staging Site: Made Public – Security Questions
- Best Way to Enable Two Step Authentication
- Securing my WordPress Files and Directories
- How to allow internal links using wp_kses filtration
- Securing a multi-user permission structure
- How does Cross Site Scripting (XSS) work exactly? [closed]
- Is default functions like update_post_meta safe to use user inputs?
- No option “I would like my site to be private, visible only to users I choose” in Privacy Settings
- vs WordPress Security
- esc_html__ security : what for in this example?
- Securing wp-config leads to sensitive information leak on wp-settings
- Suspicious Files
- What’s the point of forbidding access to wp-config.php?
- wp-json and what data does it give away?
- Is is necessary to use security plugin for wordpress? [closed]
- neccessary?
- wp-config.php being written by attacker
- XML-RPC errors they know my username?
- Is [admin / admin] acceptable for all local websites?
- Simple Online Payment for Event Registration [closed]
- Client side HTTP parameter pollution (reflected)
- Local file inclusion critical security issue [closed]
- my wordpress website is suspended [closed]
- Malware script in database post table only? [closed]
- Best practices to assert current_user_can() with guests
- XMLRPC slow and weird websites/services
- iTheme Security always lockout my account [closed]
- Is it sensible to worry about sanitizing admin input in plugin custom CSS?
- WordPress Front end Form – Enable to Submit PHP Codes
- Is it safe to hand over the admin rights?
- Is it safe use wp_editor in public contact form
- Is WordPress MultiSite secure & how much can it scale? [closed]
- How to find exploited wordpress plugin [closed]
- How safe is current_user_can()?
- Is it safe to give wordpress directories ownership to www-data?
- Do we need to escape data that we receive from theme options?
- Why does WordPress change a file’s permissions?
- Side effects of disallowing *.php requests in production environment?
- Outgoing new connection to linked Websites – why?
- My Site keeps crashing due to the wp-confg file being deleted
- Someone keeps changing my SITEURL (mysql injection or xss?) [closed]
- Who updates the wp-admin/core file?
- Replace domain in database
- Does this code indicate an exploit?
- What highest security brake with wordpress and static files?
- Spam in WordPress root folder
- Has anyone developed a anti-spam plugin to simply allow users to BLOCK whatever they wish to, but one that will also go easy on IP addresses?
- how to protect wordpress content from crawler
- Can WordPress admin user + database credentials be used to gain Cpanel or FTP access?
- Should I worry about SQL injection when using REST API?
- Links to root domain from search engines don’t work, but direct links and links from other referrers do
- How can I backup my site if it gets hacked?
- Cannot access wp admin of WordPress website (security plugin issue) [closed]
- Why are the latest visits to my website originating from my own website?
- How do I hide WordPress users from security scanning?
- Background Updates Not Happening
- wp-config.php file and code injection
- FORCE_SSL_ADMIN affecting subdomains
- What is the best security $_POST method?
- Is WordPress ready for GDPR compliance? [closed]
- Should WordPress Add Options to Enhance Security or Leave it to plugin developers? [closed]
- How do you search for backdoors from the previous IT person?
- Possible to change email address in keypair?
- Why is SSH password authentication a security risk?
- Is wp-cron.php vulnerable to external attacks and how to protect it?
- How to address security vulnerabilities: LUCKY13, BEAST, and BREACH