What is the wordpress_logged_in cookie?
The wordpress_logged_in cookie is generated automatically by WordPress core (specifically wp_set_auth_cookie() in wp-includes/pluggable.php) the moment a user successfully logs in via wp-login.php or a front-end login form, if one is present.
It is not set by a third-party plugin but by the WordPress installation itself, regardless of theme or active plugins. It only appears for accounts with a user role (administrator, editor, author, etc.), not for anonymous visitors simply browsing the site.
What data it stores
The cookie value typically contains the username, an expiration timestamp, an authentication token, and an HMAC hash used to validate integrity, separated by "|" characters. The exact format can vary slightly between WordPress versions.
The data is sent only to the site's own domain (never to external servers) and is used by WordPress to verify, on every request, whether the session is still valid. The cookie is usually scoped to the /wp-admin/ path, though WordPress may also set a site-wide variant.
What it is used for
The cookie's sole purpose is authentication: it lets WordPress recognize a user as logged in throughout a browsing session, without requiring the password to be re-entered on every admin page.
For site owners, this cookie is essential to the functioning of the admin panel — without it, editing posts, managing plugins, or moderating comments from wp-admin would be impossible.
Does it require consent?
Under CookieFix's classification, wordpress_logged_in is a strictly necessary cookie. It does not track visitors for marketing or statistics purposes; it exists solely to support the technical function of authentication.
Under Article 4(5) of Law 506/2004 (Romania's transposition of the ePrivacy Directive) and ANSPDCP guidance, cookies strictly necessary for a service explicitly requested by the user (here, authenticated access to wp-admin) are exempt from prior consent requirements. Site owners should still list it in their cookie policy, stating its purpose and duration, for transparency.
How to block or delete wordpress_logged_in
Visitors can delete or block this cookie from their browser settings (e.g., Chrome: Settings → Privacy and security → Cookies), but doing so will log them out of their WordPress account and prevent them from staying signed in.
- Because it's strictly necessary, this cookie should not — and typically cannot — be blocked pending consent by a CMP; blocking it would break login functionality for authenticated site users.
- A CMP like CookieFix automatically classifies this type of cookie as necessary and excludes it from the list of scripts blocked pending consent, while still helping the site owner document it correctly in the cookie policy.
Frequently asked questions
No, it is strictly necessary for WordPress login functionality, so it's exempt from consent requirements under ePrivacy and Law 506/2004. It should still be listed in the site's cookie policy.
You'll be automatically logged out of your WordPress account and will need to sign in again the next time you access the admin area.
No, it's only set when someone actually logs in with a WordPress account (administrator, editor, author, etc.), not from simply browsing the site.
It's a session cookie that typically expires when the browser closes, though WordPress can extend its validity if the user checks the "Remember Me" option at login.