How to Change the Joomla Session Lifetime
Joomla's Session Lifetime controls how long an inactive Joomla session remains valid before the user is treated as logged out. Increasing it can help with long administration or editing sessions; decreasing it can reduce the time an unattended authenticated browser remains usable. Set the value for your site's actual risk and workflow rather than using a universal number.
Change Session Lifetime
- Sign in to Joomla Administrator.
- Open System → Setup Panel → Global Configuration.
- Open the System tab.
- Locate the session settings and find Session Lifetime.
- Enter the intended lifetime in minutes.
- Select Save or Save & Close.
What the value means
Official Joomla programmer documentation describes the Session Lifetime value as controlling the validity period of the session cookie. If the user does not access the site again before the session expires, Joomla can treat that user as logged out. This is fundamentally an inactivity lifetime, not a promise that every authenticated browser will remain logged in for exactly that many clock minutes regardless of other activity or infrastructure.
Account for Joomla keep-alive requests
Joomla can send keep-alive AJAX requests in editing contexts so a user does not lose a session while working on a form. That means leaving an editor screen open may refresh the session and is not a reliable way to test pure inactivity. For a controlled expiration test, use a page/context that is not generating keep-alive traffic and avoid interacting with the site during the test interval.
If sessions expire sooner than the configured value
Do not assume Session Lifetime failed. Check PHP/session configuration, security extensions, single sign-on or authentication plugins, reverse proxies/load balancers, hosting controls, and application/server logs. Also determine whether the logout coincides with an IP/device policy, browser cookie deletion, deployment, cache/session-store restart, or another event that invalidates the session.
If sessions seem to last longer
Active requests and keep-alive behavior can refresh the session. Browser password managers or “remember me” style authentication can also make a new authenticated state appear similar to one uninterrupted session. Test the exact behavior you care about rather than judging only by whether a login form appears.
Balance convenience and security
Development and test sites sometimes use a longer lifetime to reduce interruptions, but production administrators may need a different balance. Consider whether administrators use shared devices, whether unattended workstations are possible, and how sensitive the site is. A very long session lifetime is not a substitute for fixing repeated unexpected logouts.
Verify the change
- Save the new value and reopen Global Configuration to confirm it persisted.
- Start a fresh test session.
- Test normal active work.
- Perform a controlled inactivity test without keep-alive traffic.
- If observed behavior differs materially, investigate the other timeout layers before changing the value again.
Need More Help with Joomla?
Still having trouble? Open a support ticket with QuantaCade Support and we'll be happy to help where we can.
Support priority is given to QuantaCade products, services, and customers. However, we're also happy to assist fellow Joomla users with general Joomla questions and troubleshooting when possible.
QuantaCade is an independent Joomla extension developer and is not official Joomla support. Some issues involving third-party extensions, hosting environments, server configurations, or other systems outside our development control may be beyond what we're able to resolve.