PHP Session Expires in 30 Minutes: 3 Best Methods + Code

Why does your PHP session live longer than needed?

Have you ever wondered why after 30 minutes of inactivity your website still remembers that you logged in? Or, conversely, do users complain that they are "kicked out" of the system too early? The problem of managing session lifetime in PHP is one of the most common headaches for beginner (and not only) developers. The question "How do I expire a PHP session after 30 minutes?" has gathered thousands of views on Stack Overflow, and for good reason.

Let's figure out how to make a PHP session die exactly after 30 minutes. We'll look at three approaches: from simple (but tricky) to professional. You'll learn why session.gc_maxlifetime often doesn't work as you expect, and how to write reliable code that won't let you down.

The Problem: what is "session lifetime" really?

Before jumping into code, let's understand the basics. A PHP session is not just a timer ticking in the browser. It's a file on the server (usually in /tmp/) that stores user data. "Expiring" a session means this file is deleted or becomes invalid.

There are three key factors that affect lifetime:

\n
• Session Cookie: the browser stores the session ID (usually in the PHPSESSID cookie). This cookie has its own lifetime.
\n
• Session file on the server: it has a last modification time (mtime).
\n
• Garbage Collector (GC): PHP periodically cleans old session files, but it does so not on a schedule, but randomly.
\n

It is because of this "three-tier" architecture that confusion arises. Setting only one parameter often does not produce the desired effect.

Method 1: Naive — only session.gc_maxlifetime

The most obvious method, which the documentation suggests, is to set session.gc_maxlifetime. It seems like this is the answer to the question "How do I expire a PHP session after 30 minutes?". But it's not that simple.

<?php\n// Start the session\nsession_start();\n\n// Set the session lifetime in seconds (30 minutes = 1800 seconds)\nini_set('session.gc_maxlifetime', 1800);\n\n// Set the session cookie lifetime to 30 minutes as well\nsession_set_cookie_params(1800);\n\n// That's it? No.\n?>

Why might this not work?

\n
• The Garbage Collector (GC) is lazy. It runs with a probability of session.gc_probability / session.gc_divisor (default 1/100). That is, even if a session file is an hour old, it might not be deleted on the next request if the GC didn't run.
\n
• Other applications. If multiple sites are running on the server, they might clean each other's sessions or, conversely, not clean yours.
\n
• Caching. On some hosting (especially shared hosting), ini_set settings may be ignored.
\n

Verdict: This method is a baseline, but not a panacea. It only works under ideal conditions. For production, you need to dig deeper.

Method 2: Manual timer inside the session (Recommended)

This approach is the sweet spot. Instead of relying on the garbage collector, we control the time of the user's last activity ourselves. This is the most popular answer on Stack Overflow regarding the topic php session expires in 30 minutes.

The idea is simple: on each request, we check when the user was last active. If more than 30 minutes have passed, we destroy the session.

<?php\nsession_start();\n\n// Session lifetime in seconds\n$session_lifetime = 1800; // 30 minutes\n\n// Check if the last activity timestamp is set\nif (isset($_SESSION['LAST_ACTIVITY'])) {\n    // Calculate the difference between the current