An Active PHP Session Was Detected: The Real Cost (2026)

https://www.ahosting.net/blog/an-acti... WordPress Site Health marks "An active PHP session was detected" as critical and files it under a blue Performance badge. Both are right, and neither tells you what is actually happening. Core never opens a PHP session. It keeps its state in cookies, the options table and transients, so a stock install cannot produce this entry at all. Something you installed did. What it costs is concurrency. PHP holds an exclusive lock on the session file for the whole request, so everything else that visitor asks for queues behind it. On a shared plan, a queued request is still a PHP worker counted against your ceiling. And the session cookie takes the page out of the full-page cache that was keeping it off PHP entirely. This video covers what the test really checks, why the loopback request deadlocks against your own session, what the lock costs against published entry-process ceilings, and why a clean Site Health screen is not evidence of a clean site. By Matt Chrust, Director of Business Development, AHosting.