What is the wordpress_sec_ cookie?
wordpress_sec_ belongs to the family of authentication cookies that WordPress core sets automatically when a user logs in. The full cookie name includes a unique hash generated by the specific installation, which is why it appears as a prefix followed by a string of characters.
The cookie only appears after a successful login to the admin area (wp-admin) or when commenting, over a secure HTTPS connection. Regular visitors who don't have an account or don't log in never receive this cookie.
What data it stores
The value contains the username, an expiration timestamp, and a cryptographic hash that WordPress uses to verify the validity of the login session, without exposing the password itself. The exact value format can vary depending on the WordPress version and any installed security plugins.
The cookie is stored locally in the visitor's browser and is sent back to the site's own domain with every request to secure areas, so the server can validate the session.
What it is used for
The cookie's purpose is to maintain a user's logged-in state (administrator, editor, author) so they don't have to re-enter credentials on every page accessed within wp-admin.
For the site owner, this cookie is essential for the WordPress dashboard to work correctly and for protecting access to restricted areas.
Does it require consent?
In CookieFix's classification, wordpress_sec_ falls under necessary (strictly necessary). Under Article 5(3) of the ePrivacy Directive (2002/58/EC), cookies strictly necessary to provide a service explicitly requested by the user (login) are exempt from prior consent requirements.
- No acceptance is required through the consent banner.
- It should still be listed, with purpose and duration, in the site's cookie policy, as required by GDPR transparency obligations.
- It should not be blocked by a CMP, since that would break the admin login functionality.
How to block or delete wordpress_sec_
A visitor can delete this cookie from their browser settings (Chrome, Firefox, Edge, Safari, under site data/cookie management), but doing so will automatically log them out of wp-admin.
Because it is strictly necessary, this cookie should not be included in the list of scripts auto-blocked pending consent. A CMP such as CookieFix scans a site's cookies and already classifies it as necessary, so it is unaffected by the automatic blocking applied to statistics or marketing scripts before consent is obtained.
Frequently asked questions
It's an authentication cookie set by WordPress when a user logs in over a secure HTTPS connection, used to keep the session active in the admin area.
It's not dangerous; it's strictly necessary for WordPress login to work correctly and shouldn't be blocked, or logged-in users will keep getting logged out.
No, since it's strictly necessary for a service explicitly requested by the user (login), it's exempt from the prior consent requirement under ePrivacy, but it should still be listed in the cookie policy.
It's typically a session cookie, deleted when the browser closes, though some WordPress configurations can extend it via the 'Remember Me' option at login.