However, sometimes I have a rather strange experience. I clearly press the 'logout' button, but about 30 minutes later, when I enter the admin address again, the dashboard opens directly without a login screen. This happens especially often in Chrome.

I am a bit concerned about security, but it turns out this is not such a strange phenomenon.

First of all, logging into a website is not just 'I logged in~ done!' as we think; there are various pieces of information moving behind the scenes.

Usually, we maintain the login state using something called a 'session cookie', which is stored in my browser.

And session cookies are supposed to disappear when the browser is closed, right?

However, modern browsers are a bit different. Browsers like Chrome and Edge temporarily remember session cookies even if you close a tab or even the browser itself. So, the login state does not disappear immediately.

Another interesting point is that even if we think we have 'logged out', the server may still be maintaining the session.

In systems with many plugins like WordPress, even if you press the logout button, the session information remaining on the server can last for several minutes to several tens of minutes. Especially if the 'Remember Me' feature is enabled, it will last even longer.

It is also common for servers to set the session timeout to about an hour, so it is not particularly unusual.

So, the login state is maintained by session cookies. The browser remembers this session cookie for a certain period. Ultimately, even if you logged out, if the server does not completely terminate the session, you can access it again without logging in.

That's why it is quite common to be able to reconnect within an hour. Of course, for sites where security is important, it would be safer to set a shorter session duration or to delete cookies upon closing the browser.

If you are worried about this issue, it may be a hassle, but you can access important admin pages in 'Chrome Incognito Mode'.

Incognito mode automatically deletes cookies and cache when the browser is closed, so you must log in again to access it. This definitely seems better for security.

If you have ever thought, "Huh? I clearly logged out, but why am I logged back in?" like me, check the session settings of your browser and server.

Real logout is something that is shaped by our usual habits :)