What is the __cf_logged_in cookie?
__cf_logged_in is an HTTP cookie tied to Cloudflare's infrastructure, the CDN and security provider used by many websites to protect against attacks and speed up content delivery.
The cookie appears when a site runs through Cloudflare and has certain caching or security rules enabled that need to distinguish logged-in visitors from anonymous ones. It is not set by every site using Cloudflare, only by configurations that require this distinction.
What data it stores
The cookie typically stores a simple indicator (such as yes/no) of the visitor's login state on that particular site, used internally by Cloudflare's mechanisms. The exact value format may vary depending on the site's configuration and is not publicly documented in detail by Cloudflare.
The data is stored in the visitor's browser and sent to the domain of the site being visited, processed by the Cloudflare infrastructure sitting in front of the origin server.
What it is used for
Its main purpose is technical: it lets Cloudflare decide whether it can serve a cached version of a page or must forward the request to the origin server to generate personalized content (for example, for a user logged into an account).
For the site owner, this cookie helps prevent situations where a logged-in user mistakenly sees a cached page meant for anonymous visitors, or vice versa.
Does it require consent?
In CookieFix's classification, __cf_logged_in is categorized as strictly necessary, since it supports correct functioning and secure content delivery rather than marketing or behavioral analysis.
- Under the ePrivacy Directive and GDPR, strictly necessary cookies do not require prior visitor consent.
- Site owners should still list it in their cookie policy, naming its purpose and provider (Cloudflare), for transparency.
- It is recommended not to block it automatically via the consent banner, to avoid breaking Cloudflare's caching behavior.
How to block or delete __cf_logged_in
A visitor can delete or block this cookie from browser settings (Chrome, Firefox, Edge, Safari) via per-site cookie management, though this may affect how content displays correctly on sites using Cloudflare for authentication handling.
Because it is classified as strictly necessary, site owners should not block it through the consent banner. For cookies in categories that do require visitor consent (statistics, marketing, preferences), CookieFix, as a CMP, can automatically block the related script until consent is given, just as it does for other third-party scripts on the site.
Frequently asked questions
No, it is a technical cookie used by Cloudflare to manage content caching correctly, not for advertising tracking or profiling.
No, since it is classified as strictly necessary, it does not require prior consent under GDPR and ePrivacy, but it must be listed in the cookie policy.
Its typical duration is session-based, meaning it is automatically deleted when the browser is closed.
On sites that use it to distinguish logged-in users from anonymous visitors, blocking it may result in an outdated cached page version being displayed.