What is the wordpress_sec cookie?
wordpress_sec is a cookie generated automatically by WordPress core when a user logs into the admin dashboard (wp-admin) or into the public side of a site via a WordPress account. It is not plugin-specific; it is part of the platform's standard authentication mechanism.
It only appears in the browser of the person logging in (administrator, editor, content author), not for regular site visitors. It is usually found alongside other similar WordPress login cookies (such as variants of the login cookie or the cookie-consent test cookie).
What data it stores
The cookie stores encrypted information related to the user's authentication session (a user identifier and a security hash generated by WordPress), used on each request to verify that the session is valid and has not been tampered with. The exact value format can vary depending on the WordPress version and server configuration, so no single public standard format is documented.
The data stays on the site's own domain (a first-party cookie) and is not sent to external servers or third parties; it is only used by the WordPress code installed on that same site to check the session.
What it is used for
The cookie's purpose is purely functional: it lets WordPress recognize that a user is logged in and keep that state as they navigate between admin pages, without requiring the password to be re-entered for every action.
For the site owner, this cookie is essential for the normal operation of the WordPress dashboard; without it, login sessions could not be maintained, and the admin area would become practically inaccessible.
Does it require consent?
wordpress_sec falls into the strictly necessary cookie category, since it is indispensable for a functionality explicitly requested by the user (logging into the admin account). Under Article 6 of Law 506/2004 (Romania's transposition of the ePrivacy Directive) and ANSPDCP's guidance, strictly necessary cookies do not require the visitor's prior consent.
- No visitor consent is required before it is set
- It should still be listed, with purpose and duration, in the site's cookie policy
- It should not be blocked by the consent banner, or the login functionality would break
How to block or delete wordpress_sec
A visitor can delete or block this cookie from browser settings (Chrome, Firefox, Edge, Safari — per-site cookie management), but the practical effect is that any active WordPress admin session will end, requiring the user to log in again.
From the site owner's perspective, since this is a strictly necessary cookie, it should not be included in the list of scripts a CMP like CookieFix auto-blocks pending consent — blocking it would break legitimate access to the admin panel. CookieFix focuses on automatically blocking statistics and marketing scripts, while letting strictly necessary cookies like wordpress_sec function normally.
Frequently asked questions
It's a session cookie set by WordPress to maintain a secure authenticated connection for users logged into the site's admin area.
No, it is classified as strictly necessary under ePrivacy/Law 506/2004, since it directly supports the login function requested by the user.
It is typically a session cookie, which is automatically deleted when the browser is closed.
The active admin session will end, and you will need to log back into WordPress.