Title: Cookie options Last modified: September 5, 2021 --- # Cookie options * Resolved [Abigailm](https://wordpress.org/support/users/abigailm/) * (@abigailm) * [5 years ago](https://wordpress.org/support/topic/cookie-options/) * Is there a way to limit the setting of cookies with this plugin? There are only a small number of users who will login or have accounts, and the cookies set by this plugin are triggering an OWASP rule in ModSecurity. (This happens when the random characters for the cookies match a security rule meant to protect against malicious code). This is resulting in users being locked out from the site. I have been running this plugin for quite a while, but this problem with the false positives only started a few days ago — but there are repeated instances. Viewing 15 replies - 1 through 15 (of 20 total) 1 [2](https://wordpress.org/support/topic/cookie-options/page/2/?output_format=md) [→](https://wordpress.org/support/topic/cookie-options/page/2/?output_format=md) * Plugin Author [Collins Agbonghama](https://wordpress.org/support/users/collizo4sky/) * (@collizo4sky) * [5 years ago](https://wordpress.org/support/topic/cookie-options/#post-14839890) * ProfilePress uses the core WordPress function wp_signon() to log in users. * WordPress does the cookie setting. * If it only recently started happening, don’t you think it is from another plugin or source? How did you come to the conclusion our plugin is responsible. * Thread Starter [Abigailm](https://wordpress.org/support/users/abigailm/) * (@abigailm) * [5 years ago](https://wordpress.org/support/topic/cookie-options/#post-14840856) * The ModSecurity logs show that the rule is being triggered by this session cookie: * ppwp_wp_session * This cookie is set in this file, at lines 37-38 as follows: * src/Classes/PPRESS_Session.php * > // Use WP_Session (default) > if ( ! defined(‘WP_SESSION_COOKIE’)) { > define(‘WP_SESSION_COOKIE’, ‘ppwp_wp_session’);} * Also, the plugin was updated on my site to version 3.1.18 at around noon on 9/ 2/2021, and the first entry in the ModSecurity logs showing access being blocked to a user because of the triggered rule happened less than an hour after the plugin update). * In sum: 1. The cookie that triggers the problem set by a file in your plugin 2. The problem started right after the most recent update to your plugin - This reply was modified 5 years ago by [Abigailm](https://wordpress.org/support/users/abigailm/). * Plugin Author [Collins Agbonghama](https://wordpress.org/support/users/collizo4sky/) * (@collizo4sky) * [5 years ago](https://wordpress.org/support/topic/cookie-options/#post-14842565) * I see what you mean. Please open a ticket via [https://profilepress.net/support/](https://profilepress.net/support/) * And we will add a filter to the plugin disable it for you. * Thread Starter [Abigailm](https://wordpress.org/support/users/abigailm/) * (@abigailm) * [5 years ago](https://wordpress.org/support/topic/cookie-options/#post-14844357) * Thanks. * [serjoug](https://wordpress.org/support/users/serjoug/) * (@serjoug) * [5 years ago](https://wordpress.org/support/topic/cookie-options/#post-14854366) * I can confirm I’m having the same problem * Plugin Author [Collins Agbonghama](https://wordpress.org/support/users/collizo4sky/) * (@collizo4sky) * [5 years ago](https://wordpress.org/support/topic/cookie-options/#post-14854396) * Please open a ticket via [https://profilepress.net/support/](https://profilepress.net/support/) * [DannyDover](https://wordpress.org/support/users/dannydover/) * (@dannydover) * [5 years ago](https://wordpress.org/support/topic/cookie-options/#post-14871610) * Hi, * I submitted a ticket regarding this issue five days ago to the link you posted, but haven’t received any kind of response. I am still experiencing the same problem. * How can I remedy this issue? * Plugin Author [Collins Agbonghama](https://wordpress.org/support/users/collizo4sky/) * (@collizo4sky) * [5 years ago](https://wordpress.org/support/topic/cookie-options/#post-14873480) * Please open a ticket [@dannydover](https://wordpress.org/support/users/dannydover/) where we will provide you with a code snippet utilizing a filter we are yet to include in an update. * [DannyDover](https://wordpress.org/support/users/dannydover/) * (@dannydover) * [5 years ago](https://wordpress.org/support/topic/cookie-options/#post-14875220) * [@collizo4sky](https://wordpress.org/support/users/collizo4sky/) I already submitted one ticket, but didn’t get any kind of response or confirmation that the ticket was received. Should I file a second ticket? * Plugin Author [Collins Agbonghama](https://wordpress.org/support/users/collizo4sky/) * (@collizo4sky) * [5 years ago](https://wordpress.org/support/topic/cookie-options/#post-14875234) * We didn’t get your ticket. Please submit it again. * [DannyDover](https://wordpress.org/support/users/dannydover/) * (@dannydover) * [5 years ago](https://wordpress.org/support/topic/cookie-options/#post-14883401) * Hi, I re-submitted the ticket to [https://profilepress.net/submit-ticket/](https://profilepress.net/submit-ticket/) but still haven’t received any confirmation that the ticket was received. I’ve tried this on two different computers on two different networks, both using the latest version of FireFox. * Were any of my tickets received? * To save us both time, the ticket is copied below: * > After upgrading to the latest version of ProfilePress, my website started reporting > a PHP Warning which indicates that a cronjob interacting with the ProfilePress > plugin (wp-user-avatar) is causing a warning related to WP_Session::set_cookie. > Log entry below: > PHP Warning · Cannot modify header information – headers already sent by (output > started at /var/www/vhosts/example.com/httpdocs/wp-cron.php:28) > [internal] > setcookie /var/www/vhosts/example.com/httpdocs/wp-content/plugins/wp-user-avatar/ > src/lib/wp_session/class-wp-session.php:135 WP_Session::set_cookie > My website doesn’t allow non-staff members to log in, so setting this cookie > is not necessary for the vast majority of my traffic. How do I disable this? * Plugin Author [Collins Agbonghama](https://wordpress.org/support/users/collizo4sky/) * (@collizo4sky) * [5 years ago](https://wordpress.org/support/topic/cookie-options/#post-14884501) * We still didn’t get your message. I’ll check if it ended up as spam. * Anyways sorry about the issue. * Replace /wp-user-avatar/src/Classes/PPRESS_Session.php with the content of [https://pastebin.com/raw/Ws3KYdW5](https://pastebin.com/raw/Ws3KYdW5) * And then use the code below to disable it. Don’t worry, the next update will contain the filter. * `add_filter('ppress_should_start_session', '__return_false');` * Please enter the plugin in a plugin eg a [site-specific plugin](https://w3guy.com/dummy-wordpress-plugin-code-snippet/) and not your theme’s functions.php file. * [threeholepunchman](https://wordpress.org/support/users/threeholepunchman/) * (@threeholepunchman) * [4 years, 8 months ago](https://wordpress.org/support/topic/cookie-options/#post-15222343) * I’m seeing this issue with ProfilePress 3.2.5 also. Was a fix ever rolled out in a patch? * Plugin Author [Collins Agbonghama](https://wordpress.org/support/users/collizo4sky/) * (@collizo4sky) * [4 years, 8 months ago](https://wordpress.org/support/topic/cookie-options/#post-15222643) * Use the [code above](https://wordpress.org/support/topic/cookie-options/#post-14884501) to disable it. * [threeholepunchman](https://wordpress.org/support/users/threeholepunchman/) * (@threeholepunchman) * [4 years, 8 months ago](https://wordpress.org/support/topic/cookie-options/#post-15222889) * Thanks for replying, but the pastebin linked above has expired. Viewing 15 replies - 1 through 15 (of 20 total) 1 [2](https://wordpress.org/support/topic/cookie-options/page/2/?output_format=md) [→](https://wordpress.org/support/topic/cookie-options/page/2/?output_format=md) The topic ‘Cookie options’ is closed to new replies. * ![](https://ps.w.org/wp-user-avatar/assets/icon-256x256.png?rev=2532486) * [Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress](https://wordpress.org/plugins/wp-user-avatar/) * [Frequently Asked Questions](https://wordpress.org/plugins/wp-user-avatar/#faq) * [Support Threads](https://wordpress.org/support/plugin/wp-user-avatar/) * [Active Topics](https://wordpress.org/support/plugin/wp-user-avatar/active/) * [Unresolved Topics](https://wordpress.org/support/plugin/wp-user-avatar/unresolved/) * [Reviews](https://wordpress.org/support/plugin/wp-user-avatar/reviews/) * 20 replies * 6 participants * Last reply from: [Collins Agbonghama](https://wordpress.org/support/users/collizo4sky/) * Last activity: [4 years, 6 months ago](https://wordpress.org/support/topic/cookie-options/page/2/#post-15445939) * Status: resolved