What is the wordpress_logged_in_ cookie?
The wordpress_logged_in_ cookie is generated by WordPress core (the user authentication system) the moment someone logs in successfully, either through wp-admin or via front-end login forms (for example, membership areas or comment systems).
The full cookie name includes a hash derived from the site's URL, appended automatically by WordPress after the wordpress_logged_in_ prefix. It only appears for authenticated users — regular site visitors never receive this cookie.
What data it stores
The cookie value typically encodes the username, an expiration timestamp, a session token, and a security hash (HMAC), which WordPress uses to verify the session's authenticity on every request.
The data stays on the site's own domain and is sent only to the site's own server (the WordPress script handling the request), not to any third-party service.
What it is used for
Its purpose is purely functional: it lets WordPress recognize an already-authenticated user throughout a session, without asking for login credentials again on every page load in the admin area or a protected section.
Without this cookie, admins, editors, or logged-in members would be constantly logged out, making site management impractical.
Does it require consent?
Classified as strictly necessary, the wordpress_logged_in_ cookie does not require visitor consent under Article 5(3) of the ePrivacy Directive (implemented in Romania via Law 506/2004) or under GDPR, since it is essential for a functionality the user explicitly requested (logging in).
- It must still be listed in the site's cookie policy, with its actual purpose and duration.
- It should not be blocked by the consent banner, but its use must be disclosed transparently.
How to block or delete wordpress_logged_in_
A logged-in visitor can delete this cookie from browser settings (Chrome, Firefox, Safari, Edge — per-site cookie management), which will log them out of their WordPress account immediately.
For site owners who want granular control over all cookies, a CMP like CookieFix can automatically block scripts that aren't strictly necessary until consent is given, though WordPress authentication cookies, being essential, remain active for logged-in users regardless of consent settings.
Frequently asked questions
No, it is a purely functional cookie used only to maintain the login session, and it does not track visitor behavior for advertising purposes.
Because it's only set when someone actually logs into the site (admin, editor, or member), not for anonymous visitors.
No, since it's strictly necessary for login functionality, it doesn't require prior consent, but it must be listed in the cookie policy.
You'll be automatically logged out of your WordPress account and will need to log in again on your next visit.