CentrioHost Blog

A cookie (also referred to as a web cookie, tracking cookie, HTTP cookie, browser cookie) is a small piece of data stored by a user’s browser (Chrome, Firefox, etc.) when they visit a website. It contains information regarding browsing activity and is typically used to personalize the user’s experience or for authentication and verification purposes. Session cookies and persistent cookies are common types of cookies.

Types of Cookies

There are two different types of cookies that are commonly set: session cookiesand persistent cookies.

Session Cookies

Session cookies, also known as transient cookies, are temporary. They don’t have an expiration date attached and only store information about what the user does during a single session. A session is simply a randomly generated/unique value that is assigned when someone visits a website. Session cookies are stored temporarily in memory and are automatically removed when the browser closes or the session ends.

Persistent Cookies

Persistent cookies, as you might have guessed, are those that contain an expiration date. These last much longer and are stored on disk until they expire or are manually cleared by the user. These are also sometimes referred to as “tracking cookies,” as these are the types of cookies that Google Analytics, AdRoll, Stripe, etc. all use.

Our Host SEO affiliate program is another example. A 60-day cookie is placed in the user’s browser when they click on an affiliate link. This ensures that the referrer gets proper credit, even if the person has closed and re-opened their browser multiple times.

How WordPress Core Uses Cookies

When we refer to WordPress core, we simply mean the files that make up the open source project, before installing any third-party plugins or themes. It’s WordPress in its natural state as we like to call it.

Now that you know the basics of what a cookie is and the different types, let’s take a look at why and how WordPress core uses them to make all that magic happen behind the scenes. Fun fact: Cookie was originally derived from the term “magic cookie.”

WordPress core uses cookies for two different purposes:

1. Login Cookies

Login cookies contain authentication details and are used when a user logs into the WordPress admin dashboard. According to the WordPress Codex, a couple of different session cookies are set:

• On login, WordPress uses the wordpress_[hash] cookie to store authentication details (limited to the /wp-admin/ area).
• After login, WordPress sets the wordpress_logged_in_[hash] cookie. This indicates when you’re logged in and who you are.

When you try to access the back-end of your WordPress site, a check is done to see if the two cookies above exist and haven’t expired. This is what allows you to magically bypass the wp-login.php screen. ?

WordPress also sets wp-settings-{time}-[UID] cookies. The ID being your user ID from the WordPress users database table. This stores personal dashboard and admin interface settings.

2. Comment Cookies

By default, there are cookies set when someone comments on a blog post (with an expiration of 347 days). This is so if they come back later they don’t have to fill out all the information all over again. The following three cookies are stored:

• comment_author_[hash]
• comment_author_email_[hash]
• comment_author_url_[hash]

However, with recent privacy policy changes due to GDPR, new tools have been introduced by WordPress core to make sure you let users opt-in to these cookies being set. This setting, if not already set, can be enabled under “Settings → Discussion” in your WordPress admin dashboard. Select the option to “Show comments cookies opt-in checkbox.” The popular Akismet plugin also allows you to display a privacy notice.

How Third-Party WordPress Plugins and Themes Use Cookies

Just like WordPress uses cookies for certain functionality, third-party plugins and themes you install also set cookies. Most of them use a combination of browser cookies and database rows stored in the wp_options table or their own custom table. This is because WordPress is stateless.

A stateless app is an application program that does not save client data generated in one session for use in the next session with that client. Each session is carried out as if it was the first time and responses are not dependent upon data from a previous session. – TechTarget

With new privacy laws, it’s more important than ever to actually understand what cookies are being set and if they are providing a way for your visitors to opt-in. Tip: not all cookies require opt-in. Read our in-depth post on GDPR to get a better understand of new requirements.

Here are just a couple of the many examples of what cookies are used for:

• If you have a popup box on your WordPress site and a visitor closes it, this typically will set a cookie so that it doesn’t come back again.
• Items added to a shopping cart on your ecommerce site. A cookie is stored so that the shopping cart keeps your products while you continue to browse around the site.
• GeoIP features might store the IP address and latitude/longitude coordinates of the visitor browsing the site. This is typically used to show specific content to a certain region or perhaps even redirect the user to a different subsite.
• Tracking activity across clicks with a link shortener like the PrettyLinks plugin.
• Newsletter plugin might set a cookie for users if they’ve already subscribed, this gives the ability to hide the newsletter box completely.

Essentially any action or opt-in on a WordPress site, typically will involve setting a cookie in the browser behind the scenes. The goal of this is, of course, to try and help improve the browser experience or provide additional functionality through verification.

WooCommerce Cookies

Ecommerce plugins such as WooCommerce typically have their own additional cookies they set so that buyers can easily add things to their cart, store for later when they checkout, and log in and out of their acco