All of a sudden neither session_destroy() nor $_SESSION=[] were sufficient to log out. I found the next to work: <?php setcookie(session_name(), session_id(), 1); // to expire the session $_SESSION = []; ?>