Glossary · Internet & Web

Cookie (HTTP Cookie)

A cookie is a small piece of data a website stores in your browser and sends back with later requests, used for sessions, preferences and tracking.

Updated October 6, 2026

A cookie is a small name-value pair that a server sets in a browser using the Set-Cookie header. The browser sends it back with each matching request, letting the site recognize a returning visitor.

Why it matters

Because HTTP is stateless, cookies are how sites keep you logged in, remember a cart or store a language choice. They are also used for analytics and advertising, which is why privacy laws and consent banners focus on them. Their attributes decide whether they are safe.

Many regions require informing visitors and, for non-essential cookies, obtaining consent first, so know which cookies your site sets and why.

Example

Set-Cookie: session_id=abc123; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=3600

Secure restricts it to HTTPS, HttpOnly hides it from JavaScript, and SameSite limits cross-site sending.

Common mistakes

  • Omitting Secure and HttpOnly on session cookies.
  • Storing sensitive data directly in a cookie instead of a server-side session.
  • Setting cookies on a broad domain so every subdomain receives them unnecessarily.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · Internet & WebWeb BrowserA web browser is software that requests pages from web servers, interprets HTML, CSS and JavaScript, and displays the result to the user.Glossary · SecurityCookie Prefixes (__Host- and __Secure-)Cookie prefixes are name prefixes that make browsers enforce extra rules, such as Secure and no Domain attribute, on that cookie.Glossary · SecurityHttpOnly CookieThe HttpOnly flag marks a cookie so that browser JavaScript cannot read it, which limits theft of session cookies through cross-site scripting.Guide · SSL & SecurityCookie Flags Explained: Secure, HttpOnly and SameSiteWhat the Secure, HttpOnly, SameSite, Domain, Path and cookie prefix attributes do, how to set them in common stacks, and how to debug cookies that go missing.7 min readGuide · E-commerceWooCommerce Checkout Errors: Troubleshooting Guide for Store OwnersDiagnose WooCommerce checkout failures step by step: caching, AJAX and REST errors, plugin conflicts, sessions, payment gateways, SSL and server limits.8 min readError fix · Browser errorsERR_CACHE_MISS: "Confirm Form Resubmission" in Chrome ExplainedERR_CACHE_MISS appears when Chrome needs data it no longer has cached, often after a form POST. Learn the visitor fixes and the developer cause.4 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.