What is the comment_author_ cookie?
comment_author_ is a native WordPress HTTP cookie, generated automatically by the built-in comment-handling function (wp-comments-post.php) — no separate plugin is required. The full cookie name includes a unique numeric suffix tied to the specific WordPress installation (e.g., comment_author_8a1f2b3c4d), which is why the exact suffix varies from site to site.
It only appears once a visitor fills in and submits the comment form under a post or page. It is not set during normal browsing — only as a result of that explicit user action.
What data it stores
The cookie stores the name a visitor enters in the "Name" field of the comment form. WordPress simultaneously sets related sibling cookies — comment_author_email_ and comment_author_url_ — for the optional email address and website fields, all sharing the same unique suffix.
The value is plain text (the name as typed by the user), with no special encryption. Data stays stored locally in the visitor's browser and is sent only to the WordPress site's own domain on each request, so the form can be pre-filled; it is not transmitted to external WordPress.org or Automattic servers.
What it is used for
The purpose is purely functional: it saves time for visitors who comment repeatedly on the same site, by automatically pre-filling their name (and, if provided, email and website) on a later visit, so they don't have to retype it every time.
For the site owner, this cookie carries no analytics or marketing value — it does not track browsing behaviour and is not used for advertising. It is a convenience cookie focused solely on improving the commenting experience.
Does it require consent?
In CookieFix's classification, comment_author_ falls under preferences (functional). While it does not track visitors for advertising purposes, it is not strictly necessary for the site's core functioning (the site works fine without it), so under Law 506/2004 (Romania's transposition of the ePrivacy Directive) and GDPR, prior visitor consent is recommended before it is set.
- The site owner should disclose it in the cookie policy, listing purpose, duration, and provider.
- Setting the cookie on comment submission should depend on consent for the preferences category, rather than happening automatically.
- If comments are restricted to logged-in users only, GDPR exposure is lower, but disclosure is still required.
How to block or delete comment_author_
A visitor can delete or block this cookie manually from browser settings (Chrome, Firefox, Edge, Safari — per-site cookie management), with no major downside: they'll simply need to retype their name on the next comment.
For site owners, blocking until consent is granted is done through a CMP that intercepts the WordPress comment form and defers setting the cookie until the visitor accepts the preferences category. CookieFix, for instance, automatically blocks this kind of functional script/cookie until consent is obtained, applying the rule to the native comment form.
Frequently asked questions
It's a functional cookie automatically set by WordPress when a visitor submits a comment, used to remember their name and pre-fill it on a future comment.
No. It does not track browsing behaviour and is not used for advertising; it only stores data from the comment form, on the site's own domain.
Yes, under CookieFix's classification it's a preferences cookie, not strictly necessary, so it should only be set after visitor consent and must be disclosed in the cookie policy.
Typically 1 year, the default set by WordPress core, though some installations or plugins may adjust it.