Do PHP sessions timeout by default - ie without any coding on my part would a user eventually be "logged out" after some time of inactivity?
It depends on the server configuration or the relevant directives session.gc_maxlifetime in php.ini
.
Typically the default is 24 minutes (1440 seconds), but your webhost may have altered the default to something else.