What is the woocommerce_cart_hash cookie?
woocommerce_cart_hash is an HTTP cookie automatically generated by WooCommerce, the most widely used e-commerce plugin for WordPress. It appears in the browser the moment a visitor adds a product to the cart on a store built with WooCommerce.
The cookie is set by the plugin's PHP code running on the site's server, not by a third-party script. It exists only for the duration of the shopping session and works alongside other WooCommerce cookies, such as woocommerce_items_in_cart, to keep the cart synchronized.
What data it stores
The cookie's value is a hash (a cryptographically generated string) calculated from the current contents of the cart – products, quantities, variations. The exact hash format may vary depending on the installed WooCommerce version.
The data stays on the site's server and in the visitor's browser; the hash is not sent to WooCommerce or Automattic (the company behind the project) and is not used to identify the person in other contexts.
What it is used for
The cookie's purpose is purely technical: it lets WooCommerce quickly check whether the cart information shown on the page (for example, via caching) still matches the actual cart contents. If the hash doesn't match, WooCommerce reloads the cart data via AJAX, preventing an outdated or incorrect cached cart from being displayed.
For site administrators, this mechanism matters especially when the site uses caching plugins (very common on WooCommerce stores), where without this cookie customers could see stale cart information.
Does it require consent?
woocommerce_cart_hash is classified as strictly necessary, since it directly supports the site's core function – the shopping cart – explicitly requested by the visitor.
- Under Law 506/2004 (Romania's transposition of the ePrivacy Directive) and GDPR, strictly necessary cookies do not require prior consent.
- The site administrator must still declare it in the site's cookie policy, along with purpose, duration, and provider.
- It should not be placed in categories that require an active opt-in (statistics, marketing, preferences).
How to block or delete woocommerce_cart_hash
A visitor can delete or block this cookie from the browser settings (e.g., Chrome: Settings → Privacy and security → Cookies). Blocking it doesn't prevent browsing, but it may cause an outdated cart to be shown on sites with aggressive caching.
For site administrators, because this cookie is strictly necessary, it should not — and in practice does not need to — be blocked before consent; it only needs to be correctly declared. A CMP platform like CookieFix helps automatically classify cookies detected on a site (including separating strictly necessary ones from those that actually require blocking until consent) and generates the corresponding cookie policy.
Frequently asked questions
No. It's a technical cookie used only to check whether the cart information is up to date; it contains no personally identifiable data and is not used for marketing.
No, since it's strictly necessary for the shopping cart functionality requested by the user, but it must still be mentioned in the site's cookie policy.
It's a session cookie – it remains active as long as the browser is open and is automatically deleted when the browser is closed.
Cached cart information displayed on the page may not update correctly, especially on sites with caching plugins enabled; the cart itself isn't necessarily lost, but visual synchronization may be affected.