Normally it's off by default with drupal. Possibly your host doesn't allow some options to be changed from default. On my non-drupal site I put the following into .htaccess: <IfModule mod_php4.c> php_value session.use_only_cookies 1 php_value session.use_trans_sid 0 </IfModule> Code (markup): But these should already be set in sites/default/settings.php (or replace default with the directory name you gave your site).