title: How to handle PHP sessions efficiently?
body: <p>This is what my <code>init.php</code> looks like that is loaded across the whole website:</p>
  
  <pre><code>$suid = 0;
  session_set_cookie_params(60, '/', '.' . $_SERVER['HTTP_HOST'], true);
  session_save_path(getcwd() . '/a/');
  if (!isset($_SESSION['id'])) {
      session_start(['cookie_lifetime' =&gt; 60]);
      $_SESSION['id'] = session_id();
      $_SESSION['start'] = date('d_m_Y_H_i');
      $_SESSION['ip'] = $_SERVER['REMOTE_ADDR'];
  } elseif (isset($_SESSION['uid'])) {
      $suid = $_SESSION['uid'];
  }
  </code></pre>
  
  <p>I'm currently testing PHP sessions, so I just put 60sec as lifetime. </p>
  
  <p>I was wondering why there were sessions created since no one knows the domain yet, so I added <code>ip</code>. I looked it up and found this out:</p>
  
  <p><a href="https://i.stack.imgur.com/Mcy8y.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Mcy8y.jpg" alt="enter image description here"></a></p>
  
  <p>So it was the Google crawler bot. Since there are more search engines and bots out there, I don't want to save these crawls in my session files and fill up my webspace with that.</p>
  
  <p>So my questions are:</p>
  
  <p>1) Even when the test lifetime value (60 seconds) is over, the session file remains in the custom directory. I read this is because I set a custom directory. Is this true?</p>
  
  <p>2) What would be an efficient way to delete all non-used/expired session files? Should I add <code>$_SESSION['last_activity']</code> with a timestamp and let a cronjob look in my custom dir, get the session file data and calculate expired sessions to delete it?</p>
  
  <p>3) Should I avoid saving those unneeded sessions by those bot crawlers just looking for the string "bot" inside <code>$_SERVER['HTTP_HOST']</code> or is there a better way to identify "non-human visitors"/crawlers?</p>
  
  <p>I also appreciate any improvements/suggestions to my code at the top. I just caused some <code>Internal Server Error</code> previously, because <code>session_start()</code> has been called to often as far I can tell from <code>php-fpm-slow</code>-logs.</p>