Title: Biscotti
Author: Jason Cosper
Published: ଜାନୁୟାରୀ 10, 2023
Last modified: ମଇ 16, 2026
---
Search plugins
# Biscotti
By [Jason Cosper](https://profiles.wordpress.org/boogah/)
[Download](https://downloads.wordpress.org/plugin/biscotti.3.0.0.zip)
* [Details](https://ory.wordpress.org/plugins/biscotti/#description)
* [Reviews](https://ory.wordpress.org/plugins/biscotti/#reviews)
* [Installation](https://ory.wordpress.org/plugins/biscotti/#installation)
* [Development](https://ory.wordpress.org/plugins/biscotti/#developers)
[Support](https://wordpress.org/support/plugin/biscotti/)
## Description
Biscotti is a plugin that modifies the expiration of the logged in user cookie in
WordPress. Choose from the default WordPress expiration (14 days), three months (
90 days), six months (180 days), or one year (365 days). Because some people hate
to have to keep entering their passwords.
#### Features
* Per-user cookie expiration settings
* Four expiration options: default, 3 months, 6 months, 1 year
* WP-CLI support for managing settings programmatically
* Fully translatable with i18n support
* Secure implementation with CSRF protection
* Clean uninstall that removes all plugin data
#### Security
Version 3.0.0 includes critical security improvements:
* CSRF protection with nonce
verification * Input validation with whitelist checking * Strict type comparisons
throughout * Modern PHP 8.0+ type hints
#### Requirements
* WordPress 6.0 or higher
* PHP 8.0 or higher
### WP-CLI Commands
As of version 2.1.0, Biscotti includes WP-CLI commands for managing a user’s logged
in session cookie expiration.
#### Get a user’s cookie expiration
```
wp biscotti get
```
Retrieves the current cookie expiration setting for a user.
Example:
wp biscotti get 123
#### Set a user’s cookie expiration
```
wp biscotti set
```
Sets the logged in session cookie expiration for a user.
Parameters:
* `` — The ID of the user * `` — One of: `default`,`
3 months`, `6 months`, `1 year`
Examples:
* Set to 1 year: `wp biscotti set 123 '1 year'` * Reset to default: `
wp biscotti set 123 default`
## Installation
1. Upload the `biscotti` folder to the `/wp-content/plugins/` directory
2. Activate the plugin through the ‘Plugins’ menu in WordPress
3. Navigate to your user profile (Users Profile) to configure your cookie expiration
## FAQ
### How do I use this plugin?
Once activated, go to Users Profile in the WordPress dashboard. You’ll see a new“
Login Cookie Expiration” section where you can choose from four options:
* Default(
14 days) – WordPress standard * 3 months (90 days) * 6 months (180 days) * 1 year(
365 days)
After changing this setting, log out and back in for the change to take effect.
### Can I set different expirations for different users?
Yes! Each user can set their own preferred cookie expiration on their individual
profile page.
### What happens to my data if I uninstall the plugin?
Starting with version 3.0.0, Biscotti includes proper uninstall cleanup. When you
delete the plugin through WordPress, all user meta data created by Biscotti will
be automatically removed from your database.
### Can I manage this via WP-CLI?
Yes! Since version 2.1.0, you can use `wp biscotti get` and `wp biscotti set` commands.
See the WP-CLI Commands section for details.
### Is this plugin secure?
Version 3.0.0 includes significant security improvements including CSRF protection,
input validation, and modern security best practices. The plugin has been hardened
against common vulnerabilities.
## Reviews
### [Thank you so much!!](https://wordpress.org/support/topic/thank-you-so-much-180/)
[protoo](https://profiles.wordpress.org/protoo/) ଅକ୍ଟୋବର 7, 2023
This plugin really helped relieve me of my “WordPress keeps logging me out” frustration,
I tried other options that promise the same features before finding this gem, and
this is the BEST, SIMPLEST one! This plugin is of HUGE help and is CRUCIAL to my
website, I don’t know what I would’ve done without it! I appreciate you SO much,
plugin author! Keep up the great work, I wish you the absolute best!
[ Read all 1 review ](https://wordpress.org/support/plugin/biscotti/reviews/)
## Contributors & Developers
“Biscotti” is open source software. The following people have contributed to this
plugin.
Contributors
* [ Jason Cosper ](https://profiles.wordpress.org/boogah/)
* [ webaware ](https://profiles.wordpress.org/webaware/)
[Translate “Biscotti” into your language.](https://translate.wordpress.org/projects/wp-plugins/biscotti)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/biscotti/), check out
the [SVN repository](https://plugins.svn.wordpress.org/biscotti/), or subscribe
to the [development log](https://plugins.trac.wordpress.org/log/biscotti/) by [RSS](https://plugins.trac.wordpress.org/log/biscotti/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 3.0.0
**Major Security & Feature Update**
* **CRITICAL SECURITY FIX:** Added CSRF protection with nonce verification on profile
form submissions
* **SECURITY:** Added input validation with whitelist checking for all user inputs
* **SECURITY:** Added user existence validation in WP-CLI commands
* **SECURITY:** Changed all loose comparisons to strict comparisons throughout
* **NEW:** Added “Default (14 days)” option to allow users to revert to WordPress
standard expiration
* **NEW:** Added full internationalization (i18n) support with text domain
* **NEW:** Enhanced form descriptions with clearer explanations
* **NEW:** Added uninstall.php for proper database cleanup on plugin deletion
* **IMPROVED:** WP-CLI commands now have better output formatting and validation
* **IMPROVED:** Added PHP 8.0+ type hints throughout codebase
* **IMPROVED:** Added comprehensive PHPDoc blocks
* **IMPROVED:** Form markup updated with ARIA roles for accessibility
* **IMPROVED:** Code organization with constants for all magic strings
#### 2.1.0
Added WP-CLI command. Bumped required PHP version to 8.0.
#### 2.0.3
@webaware has decided to help make this code less awful and submitted a pull request
on GitHub. This release implements their improvements.
#### 2.0.2
Sanitize. Not escape. Ack!
#### 2.0.1
Forgot to escape the lone `$_POST` in my code. Feel dumb about it. Fixed now tho.
#### 2.0.0
Rewrite! Now, instead of forcing _everyone_ to use the same login cookie expiration,
Biscotti allows users to individually select their login cookie expiration on their
profile page.
#### 1.0.0
Initial release. Simple plugin that forced login cookie expiration for every user
to 1 year.
## Meta
* Version **3.0.0**
* Last updated **13 hours ago**
* Active installations **20+**
* WordPress version ** 6.0 or higher **
* Tested up to **7.0**
* PHP version ** 8.0 or higher **
* Language
* [English (US)](https://wordpress.org/plugins/biscotti/)
* Tags
* [authentication](https://ory.wordpress.org/plugins/tags/authentication/)[cookies](https://ory.wordpress.org/plugins/tags/cookies/)
[login](https://ory.wordpress.org/plugins/tags/login/)[profile](https://ory.wordpress.org/plugins/tags/profile/)
[session](https://ory.wordpress.org/plugins/tags/session/)
* [Advanced View](https://ory.wordpress.org/plugins/biscotti/advanced/)
## Ratings
5 out of 5 stars.
* [ 1 5-star review ](https://wordpress.org/support/plugin/biscotti/reviews/?filter=5)
* [ 0 4-star reviews ](https://wordpress.org/support/plugin/biscotti/reviews/?filter=4)
* [ 0 3-star reviews ](https://wordpress.org/support/plugin/biscotti/reviews/?filter=3)
* [ 0 2-star reviews ](https://wordpress.org/support/plugin/biscotti/reviews/?filter=2)
* [ 0 1-star reviews ](https://wordpress.org/support/plugin/biscotti/reviews/?filter=1)
[Your review](https://wordpress.org/support/plugin/biscotti/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/biscotti/reviews/)
## Contributors
* [ Jason Cosper ](https://profiles.wordpress.org/boogah/)
* [ webaware ](https://profiles.wordpress.org/webaware/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/biscotti/)
## Donate
Would you like to support the advancement of this plugin?
[ Donate to this plugin ](http://paypal.me/boogah)