WooCommerce session rows are normal; they hold guest cart state and expire. A problem exists when creation greatly exceeds cleanup, bots create enormous numbers of carts, or database/index health makes routine reads slow.
Do not truncate the session table on a live store. That empties active guest carts and hides the growth rate without fixing its cause.
Measure size and growth
Take a database backup and inspect row count, data size and oldest/newest expiry values. Use the actual WordPress table prefix.
SELECT COUNT(*) AS session_rows,
MIN(session_expiry) AS oldest_expiry,
MAX(session_expiry) AS newest_expiry
FROM wp_woocommerce_sessions;Run read-only queries through an authorised database account. Do not paste session values into reports; serialized cart data can contain customer information.
Repeat the count after a known interval to calculate growth rather than relying on one large number.
Measure during both normal traffic and known campaign peaks because their creation rates can differ substantially.
Confirm expired-session cleanup runs
WooCommerce schedules cleanup work. Check WooCommerce > Status > Scheduled Actions for overdue or failed session-cleanup tasks and inspect WP-Cron configuration.
Low-traffic sites with WP-Cron disabled need a real server cron invoking WordPress correctly. High-traffic stores may have a backlog caused by PHP errors, locked tasks or insufficient workers.
Repair the scheduler before manually deleting rows. Otherwise the table grows again.
Separate database size from query slowness
Use the slow-query log or hosting database metrics to identify which query is expensive. A large table with healthy indexes may not be the primary bottleneck, while disk pressure or missing indexes can make smaller tables slow.
Check table status and WooCommerce’s expected schema. Do not add speculative indexes without examining query plans and compatibility with future WooCommerce updates.
Also inspect Action Scheduler and order tables; checkout latency can be blamed on sessions when another table is responsible.
Look for bot-generated carts
Bots can hit add-to-cart URLs, variation APIs or abandoned checkout flows and create sessions at machine speed. Compare session growth with access logs using aggregated IP/rate information, user agents and requested routes.
Apply rate controls to abusive patterns without blocking genuine checkout or search-engine access. Avoid a challenge on every cart request; it can break payment callbacks and accessibility.
Remove public links that unintentionally trigger add-to-cart for crawlers where appropriate.
Review custom session retention
Custom code and plugins may extend expiration or store excessive payloads. Search maintained code for WooCommerce session expiration filters and large custom session keys.
Store only short-lived checkout state needed for the transaction. Permanent preferences belong in an appropriate customer record, not an ever-growing guest session.
Changing expiry affects active carts and marketing expectations, so agree the retention period with the store owner.
Clean expired data safely
After backup and scheduler repair, use WooCommerce’s supported cleanup mechanism or a carefully bounded deletion of rows proven expired. Test on staging and schedule production work during lower traffic.
Never delete unexpired rows merely to reduce table size. Monitor locks, replication and disk space during significant maintenance.
Optimising a table may require temporary extra disk and can lock writes depending on MySQL configuration. Use the host’s supported method and rollback plan.
Verify customer and database behaviour
Track row count, expired-row count, query latency and checkout response time after repair. Create a controlled cart before maintenance and confirm its expected survival when the session is still valid.
Complete guest checkout and verify order, payment and stock. Database improvement is incomplete if active carts break.
Recurring care should alert on cleanup failures, abnormal session-creation rate, disk growth and slow checkout queries. Healthy session management combines application scheduling, bot control and measured MySQL maintenance.