Know what’s on your site before a plaintiff’s firm does
A free privacy audit shows which cookies, pixels and trackers are running — and which ones commonly appear in privacy claims.
PHPSESSID turns up on WordPress sites, ecommerce stores, membership portals and almost any custom app built on PHP. It doesn’t come from an ad network or analytics vendor. It’s the name PHP gives the cookie that ties a visitor’s browser to the session data kept on your server.
That makes it one of the few cookies most sites can classify as strictly necessary, provided it’s used the way PHP intends.
What Is the PHPSESSID Cookie?
When PHP code calls session_start(), PHP creates a random session ID and sends it to the browser in a cookie. According to the PHP manual’s session configuration reference, the cookie name comes from the session.name setting, which “Defaults to PHPSESSID.” The cookie holds only that ID. Shopping cart contents, login state and form progress stay on the server in session storage, and the ID is the claim ticket used to find them.
If you’ve never looked at one, our session cookie walkthrough shows how to find it in browser DevTools.
How Long Does PHPSESSID Last?
By default, it’s a session cookie. The PHP manual sets session.cookie_lifetime to 0, meaning the cookie lasts “until the browser is closed.” Two other settings matter:
- Server-side cleanup:
session.gc_maxlifetimedefaults to 1,440 seconds (24 minutes). After that, idle session data may be cleaned up even if the browser still holds the cookie. - Custom lifetimes: developers can raise
session.cookie_lifetimeto keep people logged in. That turns PHPSESSID into a persistent cookie, which you’ll need to disclose accurately. Our guide to session vs. persistent cookies explains the difference.
Is PHPSESSID Strictly Necessary?
Usually, yes. Keeping someone logged in, holding a cart together or stopping a multi-step form from losing data are services the user asked for, which is the test for the ePrivacy exemption. Under that reading, PHPSESSID can be set without consent in the EU and UK, though it should still be listed in your cookie policy. See our explainer on strictly necessary cookies for how regulators draw the line, and our list of functional cookie examples for cookies that sit just outside it.
The exemption is about purpose, not the cookie name. If session data is used to build analytics profiles, feed advertising, or follow visitors who never log in or buy anything, the cookie no longer fits neatly into “necessary.” Check what your application stores in $_SESSION before you classify it.
CCPA and US state laws
A session ID used only to run the site isn’t a “sale” or “sharing” of personal information. It still belongs in the list of cookies in your privacy notice.
Security Settings Worth Checking
A stolen session ID can let an attacker take over a logged-in session, so PHPSESSID is a security item as much as a privacy one. The PHP manual documents settings that reduce the risk:
session.cookie_secure = 1so the cookie is sent only over HTTPS. The default is 0.session.cookie_httponly = 1so JavaScript can’t read the cookie, which limits cross-site scripting theft. The default is also 0.session.cookie_samesite = LaxorStrictto limit cross-site requests.session.use_strict_mode = 1so PHP rejects session IDs it didn’t create, which blocks session fixation.- Regenerate the ID with
session_regenerate_id(true)at login. - Rename the cookie with
session.nameif you don’t want to advertise that the site runs PHP. This hides the technology, not the risk.
How to Delete PHPSESSID
Visitors can clear site cookies in browser settings or simply close the browser. Expect to be logged out and lose cart contents. Site owners can end a session with session_destroy() and expire the cookie at logout. Our article on the sd-session-id cookie covers a similar session pattern on other platforms.
Documenting It Correctly
Necessary cookies still need to appear in your cookie policy and banner details. A free cookie report from Captain Compliance shows whether PHPSESSID is set as a session or persistent cookie and whether it has the Secure and HttpOnly flags, and our consent banner can list it under strictly necessary so it isn’t blocked along with marketing tags.
FAQ
Does PHPSESSID track me across websites?
No. It’s a first-party cookie scoped to the site that set it, and each site creates its own ID.
Can I block PHPSESSID?
You can, but logins, carts and forms on that site will usually break.
Is PHPSESSID personal data?
It can be, because it links to a session that may contain account details. Treat it as personal data and protect it.
Does WordPress itself set PHPSESSID?
WordPress core uses its own login cookies. PHPSESSID on a WordPress site typically comes from a plugin or theme that starts a PHP session.
PHPSESSID is the rare cookie that gets less scrutiny than it deserves. Most banners wave it through as necessary, but the more important question is usually whether it’s sent over HTTPS with HttpOnly set.
Put this into practice
Turn privacy guidance into working controls.
Captain Compliance helps teams discover tracking technologies, enforce consent, manage privacy requests and document the evidence behind every decision.
