How to reduce too many sessions ?

Where does a large number of sessions come from and how to reduce them?

They are inconvenient to delete because they are created every second, which puts a strain on VPS hosting.

Sessions are stored in the /home/*/tmp folder and the contents of a session file look like this:

Example file: sess_7d73fed6db2a42800b98f9e1cdf31088

Content file:

messages|a:0:{}keepForm|a:0:{}form|a:0:{}alert_private_key|s:32:"fBC./cwEVYq4rn010Oghf/m1pFGWAr6c";alert_public_key|s:32:"vYCAxvDbJhH1.bQpmI3iAUwDQDTDO1Be";alert_signature|s:28:"Yv9ypSnCOTmVBIPogcFL1fI1Y5U=";item_ids_i_num_premium_views|a:20:{i:0;s:5:"47034";i:1;s:5:"45914";i:2;s:5:"46990";i:3;s:5:"46986";i:4;s:5:"46985";i:5;s:5:"46972";i:6;s:5:"46976";i:7;s:5:"46978";i:8;s:5:"46941";i:9;s:5:"46442";i:10;s:5:"46936";i:11;s:5:"46778";i:12;s:5:"43809";i:13;s:5:"43315";i:14;s:5:"44496";i:15;s:5:"46204";i:16;s:5:"43659";i:17;s:5:"42850";i:18;s:5:"42853";i:19;s:5:"43312";}

Clear by hourly cron:))

Yes, we do.
But why use Cron for sessions that are created every second and are probably unnecessary?
Let's find the cause.

Are you using shared hosting? The function for deleting sessions is most likely disabled there. Clean them up via a cron job—when a bot crawls without cookies, it creates thousands of sessions.

I believe this is hosting related, as this question appears once a year or so.
Several possible reasons like wrong folder for session, no auto cleanup or server specific configuration/issue.

Checked on multiple VPS hosting and the result is the same - it's not the hosting, it's not the settings.

Only the Osclass script produces such abnormal sessions that it overloads the server.

We are amazed. A miracle unseen!

Configuration:
Type:Virtual Machine
Size:vps CPU 48 RAM SSD 720
Cpu:12 vCore
RAM:48 GB
Disk:720 GB NVMe SSD
---------------------------

Here is what AI thinks:

What is most likely happening:

PHP session is started for every anonymous visitor/bot request.
Bots often do not store cookies.
Without session cookie persistence, every request creates a brand new sess_* file.
If the site is crawled aggressively (Cloudflare, Ahrefs, Semrush, MJ12bot, AI crawlers, vulnerability scanners, etc.), thousands of sessions can be generated very quickly.

The session content you posted actually supports this theory:

item_ids_i_num_premium_views
alert-related keys
empty form arrays

This looks like frontend visitor state, not some runaway memory leak.

Main issue is usually one of these:

session_start() is called globally on every request.
Sessions are started for guests even when not needed.
PHP garbage collection is ineffective or disabled.
Bots create endless fresh sessions because they do not keep cookies.
Session lifetime (gc_maxlifetime) is too high.
Cleanup probability (session.gc_probability) is too low.
Using filesystem sessions on high traffic sites.

Testing on “multiple VPS servers” does not fully prove anything because:

same PHP configuration may have been copied,
same traffic/bots hit all servers,
same Cloudflare/WAF/crawler environment,
same Osclass/plugin behavior.

A VPS with 48 GB RAM does not protect against filesystem overload if millions of tiny session files are created.

What should actually be investigated:

How often session_start() is called.
Which requests create sessions.
Whether sessions are created for bots.
Whether plugins unnecessarily initialize sessions.
PHP settings:
session.gc_probability
session.gc_divisor
session.gc_maxlifetime
session.save_path
Number of requests from bots without cookies.
Whether Cloudflare bypasses cache and hits PHP for every request.

Best solution is usually:

do not start sessions for guests unless required,
skip sessions for known bots/crawlers,
move sessions to Redis/Memcached,
reduce session lifetime,
add aggressive cleanup cron,
cache public pages properly.

Answer:

issue is real,
not necessarily hosting issue,
but also not proof that Osclass core is broken,
most likely interaction between bot traffic + PHP session handling + session initialization logic.

I am also facing same issue on my website https://ownpetz.com , too many session created , and because of this inodes limits used sometimes.

So I have created simple cron job to delete these session automatically 2 times in a day.


I am using this in my hostinger

find /home/u61654654656423/domains/ownpetz.com/public_html/oc-content/tmp -type f -delete

and i have set run this cron job 2 times in a day, this will clear session.

Maybe something smarter once an hour to delete 2 hours old sessions?
find /home/u61654654656423/domains/ownpetz.com/public_html/oc-content/tmp -type f -name "sess_*" -mmin +120 -delete

Maybe something smarter once an hour to delete 2 hours old sessions?

Code: [Select]

find /home/u61654654656423/domains/ownpetz.com/public_html/oc-content/tmp -type f -name "sess_*" -mmin +120 -delete

This does the job...good solution!

Great, thanks for feedback!